Registration Messaging in an Unlicensed Mobile Access Telecommunications System

ABSTRACT

Methods and messages for performing registration of mobile stations (MS) in an unlicensed mobile access network (UMAN). URR (UMA radio resource) registration messages are exchanged between an MS and a UMA network controller (UNC) operating in the UMAN to register the MS. The MS may access the UMAN via a wireless access point (AP) that is communicatively coupled to the UNC via an IP network. The URR registration messages are sent between the MS and the UNC using an Up interface comprising a set of layered protocols over an underlying IP transport.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims the priority of provisional patent applicationSer. No. 60/571,421, filed May 14, 2004, and entitled “Up InterfaceStage 3 Description.” This application is a Continuation in Part of andclaims the priority of U.S. Non-provisional application Ser. No.11/013,883, entitled “Apparatus and Method for Extending the CoverageArea of A Licensed Wireless Communication System Using an UnlicensedWireless Communication System,” filed Dec. 15, 2004, which is aContinuation in Part of U.S. Non-provisional application Ser. No.10/688,470, entitled “Apparatus and Method for Extending the CoverageArea of a Licensed Wireless Communication System Using an UnlicensedWireless Communication System,” filed Oct. 17, 2003. This application isalso a Continuation in Part of and claims the priority of U.S.Non-provisional application Ser. No. 11/097,866, entitled “A Method andSystem for Registering an Unlicensed Mobile Access Subscriber with aNetwork Controller,” filed Mar. 31, 2005, which claims priority toprovisional patent application Ser. No. 60/564,696, filed Apr. 22, 2004and entitled “UMA Network Controller (UNC) Selection and UMA LocationServices Support Mechanisms.”

This application is also related to commonly owned U.S. Applications:Ser. No. 10/115,833, entitled “Unlicensed Wireless Communications BaseStation to Facilitate Unlicensed and Licensed Wireless Communicationswith a Subscriber Device, and Method of Operation,” filed Apr. 2, 2002;and application Ser. No. 10/251,901, entitled “Apparatus for Supportingthe Handover of a Telecommunication Session between a Licensed WirelessSystem and an Unlicensed Wireless System,” filed Sep. 20, 2002, thecontents of each of which are hereby incorporated by reference. Inaddition, this application contains common subject matter disclosed inU.S. application Ser. Nos. ______, Attorney Matter Nos. 007090.P032,007090.P032, 007090.P032, 007090.P032, filed concurrently herewith onMay 12, 2005.

FIELD OF THE INVENTION

The field of invention relates generally to telecommunications. Moreparticularly, this invention relates to messaging employed in anunlicensed mobile access (UMA) telecommunication system that includesboth licensed and unlicensed radio infrastructure.

BACKGROUND INFORMATION

Licensed wireless systems provide mobile wireless communications toindividuals using wireless transceivers. Licensed wireless systems referto public cellular telephone systems and/or Personal CommunicationServices (PCS) telephone systems. Wireless transceivers include cellulartelephones, PCS telephones, wireless-enabled personal digitalassistants, wireless modems, and the like.

Licensed wireless systems utilize wireless signal frequencies that arelicensed from governments. Large fees are paid for access to thesefrequencies. Expensive base station (BS) equipment is used to supportcommunications on licensed frequencies. Base stations are typicallyinstalled approximately a mile apart from one another (e.g., cellulartowers in a cellular network). The wireless transport mechanisms andfrequencies employed by typical licensed wireless systems limit bothdata transfer rates and range. As a result, the quality of service(voice quality and speed of data transfer) in licensed wireless systemsis considerably inferior to the quality of service afforded by landline(wired) connections. Thus, the user of a licensed wireless system paysrelatively high fees for relatively low quality service.

Landline (wired) connections are extensively deployed and generallyperform at a lower cost with higher quality voice and higher speed dataservices. The problem with landline connections is that they constrainthe mobility of a user. Traditionally, a physical connection to thelandline was required.

In the past few years, the use of unlicensed wireless communicationsystems to facilitate mobile access to landline-based networks have seenrapid growth. For example, such unlicensed wireless systems may supportwireless communication based on the IEEE 802.11a, b or g standards(WiFi), or the Bluetooth™ standard. The mobility range associated withsuch systems is typically on the order of 100 meters or less. A typicalunlicensed wireless communication system includes a base stationcomprising a wireless access point (AP) with a physical connection(e.g., coaxial, twisted pair, or optical cable) to a landline-basednetwork. The AP has a RF transceiver to facilitate communication with awireless handset that is operative within a modest distance of the AP,wherein the data transport rates supported by the WiFi and Bluetooth™standards are much higher than those supported by the aforementionedlicensed wireless systems. Thus, this option provides higher qualityservices at a lower cost, but the services only extend a modest distancefrom the base station.

Currently, technology is being developed to integrate the use oflicensed and unlicensed wireless systems in a seamless fashion, thusenabling a user to access, via a single handset, an unlicensed wirelesssystem when within the range of such a system, while accessing alicensed wireless system when out of range of the unlicensed wirelesssystem. unlicensed wireless networks and for directing them to anappropriate network controller. In order to support more rapidimplementation by various vendors, a standardized set of messages forperforming various functions, such at registration, channel activation,handover, and the like are needed.

SUMMARY OF THE INVENTION

In accordance with aspects of the present invention, methods andmessages for performing registration of mobile stations (MSs) in anunlicensed mobile access network (UMAN) are disclosed. To facilitate theregistration of an MS, URR (UMA radio resource) registration messagesare exchanged between an MS and one or more UMA network controllers(UNCs) operating in the UMAN. By employing a wireless link using anunlicensed radio frequency, such as an 802.11-based link or a Bluetooth™link, the MS may access the UMAN via a wireless access point (AP) thatis communicatively-coupled to the UNC via an IP network. The URRhandover messages are sent between the MS and the UNC using an Upinterface comprising a set of layered protocols over an underlying IPtransport. The registration methods include both direct registrationwith a first UNC and redirection to a second UNC for registration,register rejection, and deregistration.

In another aspect of the present invention, URR registration messageswith specific formats are disclosed. The messages include a URR REGISTERREQUEST message, a URR REGISTER ACK message, a URR REJECTERREJECT/REDIRECT message, a URR REGISTER UPDATE UPLINK message, a URRREGISTER UPDATE DOWNLINK message, and a URR DEREGISTER message. Each ofthe URR registration messages includes a basic set of informationelements (IEs) including a protocol discriminator, a skip indicator, anda message type via which the message may be identified. Further IEsrelevant to each particular URR registration message are also disclosed.

BRIEF DESCRIPTION OF THE DRAWINGS

The foregoing aspects and many of the attendant advantages of thisinvention will become more readily appreciated as the same becomesbetter understood by reference to the following detailed description,when taken in conjunction with the accompanying drawings, wherein likereference numerals refer to like parts throughout the various viewsunless otherwise specified:

The foregoing aspects and many of the attendant advantages of thisinvention will become more readily appreciated as the same becomesbetter understood by reference to the following detailed description,when taken in conjunction with the accompanying drawings, wherein likereference numerals refer to like parts throughout the various viewsunless otherwise specified:

FIG. 1A provides an overview of the indoor access network (IAN) mobileservice solution in accordance with one embodiment of the presentinvention;

FIG. 1B illustrates protocol layers of a mobile set in accordance withone embodiment;

FIG. 1C illustrates a method of protocol conversion in accordance withone embodiment;

FIG. 2A illustrates an overview of a level 1, level 2, and level 3GSM-related protocol architecture for one embodiment of a mobile stationthat provides unlicensed radio links via Bluetooth signaling;

FIG. 2B illustrates an overview of a level 1, level 2, and level 3GSM-related protocol architecture for one embodiment of a mobile stationthat provides unlicensed radio links via IEEE 802.11 signaling;

FIG. 3A illustrates the Up interface protocol architecture in support ofCS Domain signaling, as well as UMA-specific signaling, according to oneembodiment;

FIG. 3B shows Bluetooth lower layers employed by a mobile station andaccess point to facilitate physical layer communications;

FIG. 3C shows Bluetooth lower layers employed by a mobile station andaccess point to facilitate physical layer communications;

FIG. 3D illustrates the Up CS domain voice bearer protocol architecturein support of GSM voice transmission, according to one embodiment;

FIG. 3E illustrates the Up GPRS user plane protocol architecture,according to one embodiment;

FIG. 3F illustrates the Up protocol architecture in support of GPRSSignaling, according to one embodiment;

FIG. 4 illustrates several possible GSM and UMA coverage scenarios inaccordance with one embodiment;

FIG. 5 illustrates exemplary mobility management functions in oneembodiment;

FIG. 6A illustrates a URR Register message exchange corresponding to asuccessful registration;

FIG. 6B illustrates a URR Register message exchange corresponding to arejected registration;

FIG. 6C illustrates a URR Register message exchange under which an MS isredirected from a first UNC to a second UNC;

FIGS. 7A and 7B are tables illustrating respective embodiments of a URRREGISTER REQUEST message format;

FIG. 8A is a table illustrating one embodiment of a URR REGISTER ACKmessage format;

FIG. 8B is a table illustrating one embodiment of a UMA GSM SystemInformation information element;

FIG. 8C is a table illustrating one embodiment of a URR REGISTER ACCEPTmessage format;

FIG. 9 is a table illustrating one embodiment of a URR REGISTERREJECT/REDIRECT message format;

FIG. 9B is a tables illustrating one embodiment of a URR REGISTER REJECTmessage format;

FIG. 9C is a table illustrating one embodiment of a URR REGISTERREDIRECT message format;

FIG. 10A illustrates a URR message sequence including a URR REGISTERUPDATE UPLINK message and a URR REGISTER REDIRECT message;

FIG. 10B illustrates a URR message sequence including a URR REGISTERUPDATE DOWNLINK message, a URR DEREGISTER message, and a URR REGISTERREDIRECT message;

FIGS. 11A and 11B are tables illustrating respective embodiments of aURR REGISTER UPDATE UPLINK message format;

FIGS. 12A and 12B are tables illustrating respective embodiments of aURR REGISTER UPDATE DOWNLINK message format;

FIGS. 13A and 13B are tables illustrating respective embodiments of aURR DEREGISTER message format;

FIG. 14 is a table illustrating one embodiment of a lookup tablecontaining 8-bit values corresponding to causes for various URR actions;

FIG. 15 illustrates a channel activation message sequence;

FIGS. 16A and 16B are tables illustrating respective embodiments of aURR ACTIVATE CHANNEL message format;

FIGS. 17A and 17B are tables illustrating respective embodiments of aURR ACTIVATE CHANNEL ACK message format;

FIGS. 18A and 18B are tables illustrating respective embodiments of aURR ACTIVATE CHANNEL FAILURE message format;

FIGS. 19A and 19B are tables illustrating respective embodiments of aURR ACTIVATE CHANNEL COMPLETE message format;

FIG. 20 illustrates a handover message sequence initiated by a mobilestation;

FIGS. 21A and 21B are tables illustrating respective embodiments of aURR HANDOVER ACCESS message format;

FIGS. 22A and 22B are tables illustrating respective embodiments of aURR HANDOVER COMPLETE message format;

FIG. 23A illustrates a handover message sequence initiated in responseto a URR UPLINK QUALITY INDICATION message sent from a UNC;

FIG. 23B illustrates a handover message sequence initiated in responseto a URR UPLINK QUALITY INDICATION message sent from a UNC, inaccordance with a handover failure;

FIG. 24 is a table illustrating one embodiment of a URR UPLINK QUALITYINDICATION message format;

FIGS. 25A and 25B are tables illustrating respective embodiments of aURR HANDOVER REQUIRED message format;

FIGS. 26A and 26B are table portions illustrating one embodiment of aURR HANDOVER COMMAND message format;

FIG. 26C is a table illustrating another embodiment of a URR HANDOVERCOMMAND message format;

FIGS. 27A and 27B are tables illustrating respective embodiments of aURR HANDOVER FAILURE message format;

FIG. 28 illustrates a URR CLEAR REQUEST message sent from a mobilestation to a UNC;

FIGS. 29A and 29B are tables illustrating respective embodiments of aURR CLEAR REQUEST message format;

FIG. 30 illustrates a URR release message sequence initiated by a UNC;

FIGS. 31A and 31B are tables illustrating respective embodiments of aURR RR RELEASE message format;

FIGS. 32A and 32B are tables illustrating respective embodiments of aURR RR RELEASE COMPLETE message format;

FIG. 33 illustrates a URR paging message sequence initiated by a UNC;

FIGS. 34A and 34B are tables illustrating respective embodiments of aURR PAGING REQUEST message format;

FIGS. 35A and 35B are tables illustrating respective embodiments of aURR PAGING RESPONSE message format;

FIG. 36 illustrates a URR classmark message sequence initiated by a UNC;

FIGS. 37A and 37B are tables illustrating respective embodiments of aURR CLASSMARK ENQUIRY message format;

FIGS. 38A and 38B are tables illustrating respective embodiments of aURR CLASSMARK CHANGE message format;

FIG. 39 is a schematic block diagram illustrating one embodiment of ahigh-level architecture of a UNC; and

FIG. 40 is a schematic block diagram illustrating one embodiment of ahigh-level architecture of a mobile station.

DETAILED DESCRIPTION

In the following description, numerous specific details are set forth toprovide a thorough understanding of embodiments of the invention. Oneskilled in the relevant art will recognize, however, that the inventioncan be practiced without one or more of the specific details, or withother methods, components, materials, etc. In other instances,well-known structures, materials, or operations are not shown ordescribed in detail to avoid obscuring aspects of the invention.

Reference throughout this specification to “one embodiment” or “anembodiment” means that a particular feature, structure, orcharacteristic described in connection with the embodiment is includedin at least one embodiment of the present invention. Thus, theappearances of the phrases “in one embodiment” or “in an embodiment” invarious places throughout this specification are not necessarily allreferring to the same embodiment. Furthermore, the particular features,structures, or characteristics may be combined in any suitable manner inone or more embodiments.

In the present description the unlicensed wireless system may be ashort-range wireless system, which may be described as an “indoor”solution. However, it will be understood through the application thatthe unlicensed wireless system includes unlicensed wireless systems thatcover not only a portion of a building but also local outdoor regions,such as outdoor portions of a corporate campus serviced by an unlicensedwireless system. The mobile station may, for example, be a wirelessphone, smart phone, personal digital assistant, or mobile computer. The“mobile station” may also, for example, be a fixed wireless deviceproviding a set of terminal adapter functions for connecting IntegratedServices Digital Network (ISDN) or Plain Old Telephone Service (POTS)terminals to the wireless system. Application of the present inventionto this type of device enables the wireless service provider to offerso-called landline replacement service to users, even for user locationsnot sufficiently covered by the licensed wireless system. The presentdescription is in the context of the UMA (Unlicensed Mobile Access)standardized architecture as promulgated by the UMA consortium. However,the invention is not so limited.

Throughout the following description, acronyms commonly used in thetelecommunications industry for wireless services are utilized alongwith acronyms specific to the present invention. A table of acronymsspecific to this application is included in Appendix 1.

FIG. 1A illustrates an Unlicensed Mobile Access (UMA) architecture 100in accordance with one embodiment of the present invention. UMAarchitecture 100 enables a user of a mobile station 102 to access avoice and telecommunications network 104 via either a licensed wirelesscommunications session 106, or an unlicensed wireless communicationsession 108. The telecommunications network 104 includes a mobileswitching center (MSC) 110, which provides access to a voice network112, and a Serving GPRS (General Packet Radio Service) Support Node(SGSN) 114, which provides access to a data network 116. MSC 110 alsoprovides an internal visitor location register (VLR) function.

In further detail, the licensed wireless communication session isfacilitated by infrastructure provided by a licensed wireless network118 that includes telecommunications network 104. In the illustratedembodiment, licensed wireless network 118 depicts components common to aGSM-(Global System for Mobile Communication) based cellular network thatincludes multiple base transceiver stations (BTS) 120 (of which only oneis shown for simplicity) that facilitate wireless communication servicesfor various mobile stations 102 via respective licensed radio links 122(e.g., radio links employing radio frequencies within a licensedbandwidth). Typically, the multiple BTSs 120 are configured in acellular configuration (one per each cell) that covers a wide servicearea. The various BTSs 120 for a given area or region are managed by abase station controller (BSC) 124, with each BTS 120communicatively-coupled to its BSC 124 via a private trunk 126. Ingeneral, a large licensed wireless network, such as that provided by aregional or nationwide mobile services provider, will include multipleBSCs 124.

Each BSC 124 communicates with telecommunications network 104 through astandard base station controller interface 126. For example, a BSC 124may communicate with MSC 110 via the GSM A-interface for circuitswitched voice services and with SGSN 114 via the GSM Gb interface forpacket data services (GPRS). Conventional licensed voice and datanetworks 104 include protocols to permit seamless handoffs from onerecognized BSC 124 to another BSC (not shown).

An unlicensed communication session 108 is facilitated via an (wireless)access point (AP) 128 comprising an indoor base station 130. Typically,AP 128 will be located in a fixed structure, such as a home 132 or anoffice building 134. The service area of indoor base station 130includes an indoor portion of a building, although it will be understoodthat the service area of an indoor base station may include an outdoorportion of a building or campus. As indicated by the arrow representingunlicensed communication session 108, the mobile station 102 may beconnected to the telecommunications network 114 via a second data paththat includes an unlicensed wireless channel 136, access point 128, anaccess network 138, and an unlicensed mobile access network controller(UNC) 140. The UNC 140 communicates with telecommunications network 104using a base station controller interface 126B that is similar to basestation controller interface 126A, and includes a GSM A interface and Gbinterface. AP 128 may include software entities stored in memory andexecuting on one or more microprocessors (not shown in FIG. 1A) adaptedto perform protocol conversion.

The unlicensed wireless channel 136 is facilitated by a radio linkemploying a wavelength (or wavelength range) in an unlicensed, freespectrum (e.g., spectrum around 2.4 GHz, 5 GHz, 11-66 GHz). Anunlicensed wireless service hosting unlicensed wireless channel 136 mayhave an associated communication protocol. As examples, the unlicensedwireless service may be a Bluetooth™ compatible wireless service, or awireless local area network (LAN) (WiFi) service (e.g., the IEEE802.11a, b, or g wireless standard). This provides the user withpotentially improved quality of service in the service regions of theunlicensed wireless service (i.e., within the service range of acorresponding AP). Thus, when a subscriber is within range of theunlicensed AP, the subscriber may enjoy low cost, high speed, and highquality voice and data services. In addition, the subscriber enjoysextended service range since the handset can receive services deepwithin a building at locations that otherwise may not be reliablyserviced by a licensed wireless system. At the same time, the subscribercan roam outside the range of the unlicensed AP without droppingcommunications. Instead, roaming outside the range of the unlicensed APresults in a seamless handoff (also referred to as a handover) whereincommunication services are automatically provided by the licensedwireless system, as described in more detail in U.S. patent applicationSer. No. 10/115,833, the contents of which are hereby incorporated byreference.

Mobile station 102 may include a microprocessor and memory (not shown)that stores computer program instructions for executing wirelessprotocols for managing communication sessions. As illustrated in FIG.1B, in one embodiment the mobile station 102 includes a layer 1 protocollayer 142, layer 2 protocol layer 144, and a layer 3 signaling protocollayer for the licensed wireless service that includes a radio resource(RR) sublayer 146, a mobility management (MM) sublayer 148, and a callmanagement (CM) layer 150. It will be understood that the level 1, level2, and level 3 layers may be implemented as software modules, which mayalso be described as software “entities.” In accordance with a commonnomenclature for licensed wireless services, layer 1 is the physicallayer, i.e., the physical baseband for a wireless communication session.The physical layer is the lowest layer of the radio interface andprovides functions to transfer bit streams over physical radio links.Layer 2 is the data link layer. The data link layer provides signalingbetween the mobile station and the base station controller. The RRsublayer is concerned with the management of an RR-session, which is thetime that a mobile station is in a dedicated mode, as well as theconfiguration of radio channel, power controller, discontinuoustransmission and reception, and handovers. The mobility management layermanages issues that arise from the mobility of the subscriber. Themobility management layer may, for example, deal with mobile stationlocation, security functions, and authentication. The call controlmanagement layer provides controls for end-to-end call establishment.These functions for a licensed wireless system are well known by thosein the art of wireless communication.

The mobile station may also include an unlicensed wireless servicephysical layer 152 (i.e., a physical layer for unlicensed wirelessservice such as Bluetooth, WiFi, or other unlicensed wireless channel(e.g., WiMAX)). The mobile station also includes an unlicensed wirelessservice level 2 link layer 154, and an unlicensed wireless service radioresource sublayer(s) 156. An access mode switch 160 is included for themobile management 148 and call management layers 150 to access theunlicensed wireless service radio resource sublayer 156 and unlicensedwireless service link layer 154 when the mobile station 102 is withinrange of an unlicensed AP 128 and to support switching between licensedRR sublayer 146 and unlicensed wireless service RR sublayer 156.

The unlicensed radio resource sublayer 156 and unlicensed link layer 154may include protocols specific to the unlicensed wireless serviceutilized in addition to protocols selected to facilitate seamlesshandoff between licensed and unlicensed wireless systems. Consequently,the unlicensed radio resource sublayer 156 and unlicensed link layer 154need to be converted into a format compatible with a conventional basestation controller interface protocol 126 recognized by a MSC, SGSN, orother voice or data network.

Referring to FIG. 1C, in one embodiment of the present invention, themobile station 102, AP 128 and UNC 140 provide an interface conversionfunction to convert the level 1, level 2, and level 3 layers of theunlicensed service into a conventional base station subnetwork (BSS)interface 126B (e.g., an A-interface or a Gb-interface). As a result ofthe protocol conversion, a communication session may be established thatis transparent to the voice network/data network 104, i.e., thevoice/data network 104 uses its standard interface and protocols for thecommunication session as it would with a conventional communicationsession handled by a conventional base transceiver station. For example,in some embodiments the mobile station 102 and UNC 140 are configured toinitiate and forward location update and service requests. As a result,protocols for a seamless handoff of services that is transparent tovoice/data network 104 are facilitated. This permits, for example, asingle phone number to be used for both the licensed wireless serviceand the unlicensed wireless service. Additionally, the present inventionpermits a variety of services that were traditionally offered onlythrough licensed wireless services to be offered through an unlicensedwireless service. The user thus gets the benefit of potentially higherquality service when their mobile station is located within the areaserviced by a high bandwidth unlicensed wireless service while alsohaving access to conventional phone services.

The licensed wireless service may comprise any licensed wireless servicehaving a defined BSS interface protocol 126 for a voice/data network104. In one embodiment, the licensed wireless service is a GSM/GPRSradio access network, although it will be understood that embodiments ofthe present invention include other licensed wireless services. For thisembodiment, the UNC 140 interconnects to the GSM core network via thesame base station controller interfaces 126 used by a standard GSM BSSnetwork element. For example, in a GSM application, these interfaces arethe GSM A-interface for circuit switched voice services and the GSM Gbinterface for packet data services (GPRS). In a UMTS (Universal MobileTelecommunications System) application of the invention, the UNC 140interconnects to the UMTS network using a UMTS Iu-cs interface forcircuit switched voice services and the UMTS Iu-ps interface for packetdata services. In a CDMA application of the invention, the UNC 140interconnects with the CDMA network using the CDMA A1 and A2 interfacesfor circuit switched voice services and the CDMA A10 and A11 interfacesfor packet data services.

In a GSM/GPRS embodiment, UNC 140 appears to the GSM/GPRS core networkas a GSM BSS network element and is managed and operated as such. Inthis architecture the principle elements of transaction control (e.g.,call processing) are provided by higher network elements; namely the MSC110 visitor location register (VLR) and the SGSN 114. Authorized mobilestations are allowed access to the GSM/GPRS core network either directlythrough the GSM radio access network if they are outside of the servicearea of an AP 128 or via the UMA network system if they are within theservice area of an AP.

Since a communication session hosted by the UMA architecture 100 istransparent to a voice network 112 or data network 116, the unlicensedwireless service may support all user services that are typicallyoffered by a wireless service provider. In the GSM case, this typicallyincludes the following basic services: Telephony; Emergency call (e.g.,E911 calling in North America); Short message, mobile-terminatedpoint-to-point (MT/PP); Short message, mobile-originated point-to-point(MO/PP); GPRS bearer services; and Handover (outdoor-to-indoor,indoor-to-outdoor, voice, data, SMS, SS). Additionally, GSM may alsosupport, various supplementary services that are well-known in the art.

FIG. 2A provides an overview of a level 1, level 2, and level 3GSM-related protocol architecture for one embodiment of mobile station102 that provides unlicensed radio links via Bluetooth signaling. Asillustrated, there are two logical radio resource (RR) managemententities: the GSM RR entity 202 and the UMA-RR entity 204. The protocolarchitecture includes a GSM baseband level 1 layer 206, GSM level 2 linklayer (LAPDm) 208, Bluetooth baseband level 1 layer 210, Bluetooth level2 layers 211 including a layer 2 connection access procedure (L2CAP)layer 212 and a BNEP layer 213, an access mode switch 214, and upperlayer protocols 216. When the mobile station is operating in an UMAmode, the UMA-RR entity 204 is the current “serving” RR entity providingservice to the mobility management (MM) sublayer via the designatedservice access point (RR-SAP). The GSM RR entity is detached from the MMsublayer in this mode. The UMA-RR entity 204 provides a new set offunctions, and is responsible for several tasks. First the UMA-RR entityis responsible for discovery of UMA coverage and UMA registration.Second, the UMA-RR entity is responsible for emulation of the GSM RRlayer to provide the expected services to the MM layer; i.e., create,maintain and tear down RR connections. All existing GSM 04.07 primitivesdefined for the RR-SAP apply. The plug-in of UMA-RR entity 204 is madetransparent to the upper layer protocols in this way. Third, a UMA-RRentity 204 module is responsible for coordination with the GSM RR entityto manage access mode switching and handover, as described in furtherdetail in application Ser. No. 10/688,470 referenced above.

FIG. 2B provides an overview of a level 1, level 2, and level 3GSM-related protocol architecture for one embodiment of mobile station102 that provides unlicensed radio links via IEEE 802.11 signaling. Allof the entities and layers are the same as described above for FIG. 2A,except that the Bluetooth layers have been replaced with an 802.11 PHYlayer 218 and an 802.11 MAC layer 220.

FIG. 3A illustrates the Up interface protocol architecture in support ofcircuit switched (CS) Domain signaling, as well as UMA-specificsignaling, according to one embodiment. The MSC sublayers areconventional, well known features known in the art in regards to themessage transfer part (MTP) interfaces MTP1 302, MTP2 304, and MTP3 306,signaling connection control part (SCCP) 308, base station systemapplication part (BSSAP) 310, mobility management interface 312, andconnection management interface 314.

The UMA-RR protocol supports the UMA “layer 3” signaling functions viaUMA-RR layers 204 provided by each of the mobile station 102 and UNC140. The UNC 140, acting like a BSC, terminates UMA-RR protocol messagesand is responsible for the interworking between these messages and theanalogous A-interface messages.

The layers below the UMA-RR layer 204 in each of mobile station 104 andUNC 140 include a TCP layer 316, a remote IP layer 318, and an IPSec (IPsecurity) layer 320. As an option, a standard Secure Socket Layer (SSL)protocol running over TCP/IP (not shown) may be deployed in place ofIPSec layer 320.

Lower-level IP connectivity between mobile station 102 and UNC 140 issupported by appropriate layers hosted by an intervening access point128 and broadband IP network 138 (i.e., the access network 138 shown inFIG. 1A). The components for supporting the IP transport layer (i.e.,the conventional network layer 3 under the seven-layer OSI model)include a transport IP layers 322 for each of the mobile station 104, AP128, and IP network 138, and an IP layer 322A at UNC 140.

At the lowest layers (i.e., the physical and data link layers), mobilestation 104 and AP 128 are depicted as providing unlicensed lower layers324, while each of AP 128, IP network 138, and UNC 140 provideappropriate access layers 326. Typically, access layers 326 will includeconventional Ethernet PHY and MAC layers (IEEE 802.3), although this isnot limiting.

As shown in FIGS. 3A and 3B, the unlicensed layers lower layers 324 willdepend on whether the unlicensed radio link uses Bluetooth signaling orIEEE 802.11 signaling. The Bluetooth lower layers depicted in FIG. 3Acorrespond to the mobile station architecture of FIG. 2A, and include aBluetooth baseband layer 210, an L2CAP layer 212, and a BNEP layer 213.Meanwhile, the 801.11 lower layers shown in FIG. 3B correspond to themobile station architecture of FIG. 2B, and include a 802.11 PHY layer218 and in 802.11 MAC layer 220.

FIG. 3D illustrates the Up CS domain voice bearer protocol architecturein support of GSM voice transmission, according to one embodiment. Inaddition to the like named and referenced components common to thearchitectures of FIGS. 3D and 3C, facilities are provided for supportingGSM voice transmission. For the MSC 110, these components includeconventional components for supporting GSM voice transmissions, and aredepicted as physical layers 330 and audio 332, with similar componentsbeing deployed in UNC 140. Each of mobile station 102 and UNC 140 nowinclude a GERAN (GSM Edge Radio Access Network) codec 334 and an RTP/UDPlayer 336.

Under the architecture of FIG. 3D, audio flows over the Up interfaceaccording to the RTP framing format defined in RFC 3267 and RFC 3551.When operating in UMA mode, support for AMR FR as specified in TS 26.103is supported. Other codecs may also be supported, such as G.711.

FIG. 3E illustrates the Up GPRS user plane protocol architecture,according to one embodiment. The Up GPRS user plane protocolarchitecture effectively enables the tunneling of GPRS signaling anddata packets through the UNC 140 utilizing the unlicensed spectrum, thussupporting a tunneling function for packet-switched traffic between themobile station 102 and SGSN 118.

As illustrated in FIG. 3E, each of the UNC 140 and SGSN 114 employconventional facilities for supporting GPRS signaling and data packets,including a physical layer 350, a network service layer 352, and a BSSGPlayer 354. Each of mobile station 102 and UNC 140 include a UDP layer356 and a UMA-RLC layer 358. Each of mobile station 102 and SGSN includean LLC layer 360 and an SNDCP layer 362. Mobile station 102 alsoincludes an IP layer 364.

Under the architecture of FIG. 3E, GPRS LLC PDUs carrying data, andhigher layer protocols, are carried transparently between the mobilestation 102 and SGSN 114. This allows the mobile station to derive allGPRS services in the same manner as if it were in a GERAN BSS. Allexisting GPRS applications and MMI in mobile station 102 are unchanged.LLC PDUs are carried over UMA-RLC layer 358 from mobile station 102 toUNC 140, which relays the PDUs over to SGSN 114 using BSSGP messaging.The UMA-RLC layer 358 runs directly over the UDP layer 356 to leveragethe IP bearer service.

FIG. 3F illustrates the Up protocol architecture in support of GPRSSignaling, according to one embodiment. Under this architecture, theGPRS LLC PDUs for signaling on higher layer protocols (including upperlayers 366) are carried transparently between MS 102 and SGSN 114. Thisallows the MS to obtain all GPRS services in the same ways as if it wereconnected to a GERAN BSS. The GPRS-RLC protocol is replaced with anequivalent (from the upper layer perspective) UMA-RLC protocol.Reliability is ensured by TCP layer 357. As in a GERAN BSS, the UNC,acting like a BSC, terminates the UMA-RLC protocol and inter-works it tothe Gb-interface using BSSGP.

As noted above, the mobile station may be, for example, a wirelessphone, smart phone, personal digital assistant, or mobile computer. Themobile station may also be, for example, a fixed wireless deviceproviding a set of terminal adapter functions for connecting IntegratedServices Digital Network (ISDN) or Plain Old Telephone Service (POTS)terminals to the wireless system.

Other terminal adapter types than those listed above may be employedwith embodiments of the present invention. For example: (1) a terminaladapter that supports cordless telephones rather than POTS phones; (2) aterminal adapter that supports standard Session Initiation Protocol(SIP) telephones; and (3) a terminal adapter that also integrates acorded handset and user interface, such as one would find on a deskphone. In each case, the invention described herein describes how theseterminal adapter functions can be connected to the wireless system viathe unlicensed network.

The use of other standard Bluetooth capabilities together withembodiments of the present invention is possible. For example, there isa Bluetooth standard capability called “SIM Access Profile” that allowsone Bluetooth device (e.g., an embedded cell phone subsystem in a car)to access the SIM that is in another Bluetooth device (e.g., the user'snormal cell phone), allowing the first device to take on the“personality” associated with the SIM (i.e., that of the user's normalcell phone). The embodiments described above could make use of thisstandard capability to give the terminal adapter-attached devices (e.g.,a POTS phone) the personality of the user's cell phone.

Mobility Management

The UNC 140 provides functions equivalent to that of a GSM BSC, and assuch controls one or more (virtual) UMA cells. In one embodiment, theremay be a single UMA cell per UNC and, in an alternative embodiment,there may be one UMA cell per access point connected to a UNC. Thelatter embodiment may be less desirable due to the large number of APsexpected to be used, so the UMA architecture permits flexible groupingsof APs into UMA cells. Each UMA cell may be identified by a cell globalidentifier (CGI), with an unused absolute radio frequency channel number(ARFCN) assigned to each UMA cell. Each UMA cell may be mapped to aphysical boundary by associating it with specific GSM location areasserved by the MSC. GSM cells within the location areas mapped to a UMAcell are configured with ARFCN-to-CGI mappings for that UMA cell.Further, this ARFCN may be advertised in the BA list by the GSM cells topermit handovers. Note that UMA cells may use the same location areaidentifiers (LAI) as existing GSM cells, or a new LAI may be used forUMA cells. The latter is useful in reducing paging in GSM cells when amobile station is known to be registered via an INC. The abovediscussion applies equally to GPRS routing areas and routing areaidentifiers (RAIs).

UMA CPE Addressing

Customer premise equipment (CPE) may include the mobile station and theaccess point (AP) through which the mobile station may access the UNCfor UMA service. UMA CPE addressing parameters may include theparameters described below.

The UMA CPE addressing includes the international mobile subscriberidentity (IMSI) associated with the SIM in the mobile equipment as aparameter. The IMSI is provided by the UMA mobile station to the UNCwhen it requests UMA service via the Up interface to the UNC. Unlike theGSM BSC, the UNC manages a context for each mobile station that isoperating in UMA mode. Therefore, the UNC maintains a record for eachserved mobile station. For example, IMSI may be used by the UNC to findthe appropriate mobile station record when the UNC receives a BSSMAPpaging message.

The UMA CPE addressing includes the address associated with theunlicensed interface in the mobile equipment (e.g., 802.11 MAC address)as a parameter. This identifier may be provided by the UMA mobilestation to the UNC when it requests UMA service via the Up interface.The UNC may use this address as an alternative to the IMSI to limit thetransfer of the IMSI over the Up interface and to assist in the routingof messages.

The UMA CPE addressing also includes the temporary logical linkidentifier (TLLI) assigned to the mobile station by the serving GPRSsupport node (SGSN) as a parameter. This identifier may be provided viastandard Gb-interface procedures. The UNC may track this address foreach served mobile station to support GSM Gb-interface procedures (e.g.,so that downlink GPRS packets may be routed to the correct mobilestation).

The UMA CPE addressing also includes the access point ID (AP-ID) as aparameter. The AP-ID may be the MAC address of the unlicensed modeaccess point through which the mobile station is accessing UMA service.This identifier may be provided by the UMA mobile station to the UNCwhen it requests UMA service via the Up interface. The AP-ID may be usedby the UNC to support location services (e.g., enhanced 911 service) tothe user based on the AP from which the service is being accessed. TheAP-ID may also be used by the service provider to restrict UMA serviceaccess only to authorized APs.

Other CPE addressing parameters that may be used depend on the securityrequirements of the Up interface (e.g., the need to manage UMA mobilestation IP addresses for message routing via tunneled IPSec connections,or the need to manage local credentials assigned to the mobile stationby the UNC).

UMA Cell Identification

In order to facilitate the mobility management functions in GSM/GPRS,the coverage area may be split into logical registration areas calledlocation areas (for GSM) and routing areas (for GPRS). Mobile stationsmay be required to register with the network each time the servinglocation area (or routing area) changes. One or more location areasidentifiers (LAIs) may be associated with each visited location register(VLR) in a carrier's network. Likewise, one or more routing areaidentifiers (RAIs) may be controlled by a single SGSN.

In one embodiment, a GSM cell is identified within the location orrouting area by adding a cell identity (CI) to the location or routingarea identification. The cell global identification (CGI) is theconcatenation of the location area identification and the cell identity.In one embodiment, the cell identity is unique within a location area.

An Example UMA Approach to Cell Identification

One example of a UMA cell identification approach is described below. Inthis embodiment, a single UNC provides service for one or more UMAlocation areas and one or more UMA routing areas, and each UMA locationarea (or routing area) is distinct from, or the same as, the locationarea (or routing area) of the overlapping GSM cell. A UMA cell isidentified within the UMA location or routing area by adding a cellidentity (CI) to the location or routing area identification. The UMAcell global identification (UMA-CGI) is the concatenation of thelocation area identification and the cell identity. In one embodiment, aUMA cell may be a pre-defined partition of the overall UMA coverage areaidentified by a UMA-CGI value. Note that cell identification, like UMAinformation, may be transparent to the AP, such that the AP is not awareof its associated UMA-CGI value. The UMA components (e.g., mobilestation and UNC) may support the ability to partition the overall UMAcoverage area.

A partitioning method may include implementing a one-to-one or amany-to-one correspondence between GSM cell identity and UMA cellidentity. Given the identification of a preferred GSM cell in aparticular area, it may be possible to determine the corresponding UMAcell identity based, for example, on UNC provisioning. An example of aone-to-one relationship is mapping a GSM cell to a UMA cell. An exampleof a many-to-one relationship is mapping a GSM location area (andassociated GSM cells) to a UMA cell.

When a UMA mobile station connects to the UNC for UMA service, it sendsthe CGI value and (optionally) a path loss criterion parameter (C1) ofthe current GSM camping cell, as well as the neighbor cells, to the UNC.The UNC maps the GSM camping cell's CGI value to a corresponding UMAcell's CGI value based on mapping logic provisioned in the UNC. This maybe a one-to-one mapping (e.g., if there is one UMA cell per GSM cell) ora many-to-one mapping (e.g., if there is one UMA cell per GSM locationarea). If no GSM coverage is available in the UMA service area, the UNCmay assign the mobile station to a default “no GSM coverage” UMA cell. Asingle UNC may serve one MSC. This does not preclude UNC embodimentsthat combine multiple UNC “instances,” as defined above, in a singledevice (for example, a UNC that servers multiple MSCs). Each UNC mayalso be assigned a unique “UMA-Handover-CGI” value used for GSM-to-UMAhandover purposes. For example, this may be the value provisioned in theGSM RAN BSC's ARFCN-to-CGI tables and in the MSCs (e.g., to point to theUNC).

UMA Operating Configurations

In one embodiment, at least three UMA operating configurations may beidentified. In a common core configuration, the UMA LAI and an umbrellaGSM RAN LAI (e.g., that serves the subscriber's neighborhood) may bedifferent, and the network may be engineered such that the same corenetwork entities (e.g., MSC and SGSN) serve both the UMA cells and theumbrella GSM cells. One advantage of this configuration is thatsubscriber movement between the UMA coverage area and the GSM coveragearea does not result in inter-system (e.g., MAP) signaling (e.g.,location updates and handovers are intra-MSC).

In a separate core configuration, the UMA LAI and umbrella GSM RAN LAIare different, and the network may be engineered such that differentcore network entities serve the UMA cells and the umbrella GSM cells.One advantage of this configuration is that engineering of the UMA andGSM networks can be more independent than in the Common CoreConfiguration.

In a common LAI configuration, the UMA LAI and GSM RAN LAI are the same(e.g., different cells within the same LAI). Advantages of thisconfiguration are that subscriber movement (while idle) between the UMAcoverage area and the GSM coverage area may not result in any locationupdate signaling, and that the mobile station can easily switch to GSMmode if UMA mode resources are temporarily unavailable (e.g., to respondto paging). Further details of this and the foregoing separate coreconfiguration are discussed in application Ser. No. 10/688,470.

UMA Registration and Deregistration

In one embodiment, as described above, a UMA registration process doesnot employ signaling to the PLMN infrastructure and is contained withinthe UMA system (i.e., between the mobile station and UNC). The UMAregistration process may serve at least two purposes. It may inform theUNC that a mobile station is connected through a particular AP and isavailable at a particular IP address. The UNC may keep track of thisinformation, for example, for mobile-terminated calling. Theregistration process may also provide the mobile station with theoperating parameters associated with the UMA service on the AP. This maybe analogous to the use of the GSM broadcast control channel (BCCH) totransmit system parameters to mobile stations in GSM cells. GSM systeminformation message content that is applicable in UMA mode may bedelivered to the mobile station during the UMA registration process.

Similarly, a UMA deregistration process may allow the mobile station toexplicitly inform the UNC that it is leaving UMA mode, allowing the UNCto free resources that it may have assigned to the mobile station. TheUNC may also support implicit UMA deregistration, wherein a securechannel to the mobile station is abruptly terminated.

UMA Redirection

In one embodiment, as described above, when a UMA mobile stationconnects to the UNC for UMA service, it may send a CGI value and a pathloss criterion parameter (C1) of the current GSM camping cell, as wellas the neighbor cells, to the UNC. Using this information, as well asinternal database information, the UNC may be able to determine if it isthe correct serving UNC for the mobile station, and if it is not thecorrect serving UNC, to redirect the mobile station to the correct UNC.The correct serving UNC may be the UNC whose UMA service area overlapsthe mobile station's umbrella GSM coverage. In one embodiment, thecorrect serving UNC might be attached to the same MSC as the GSM BSC towhich the umbrella GSM cell belongs. In an alternative embodiment, thecorrect serving UNC might be attached to a different MSC that mayhand-over to the MSC that provides umbrella GSM coverage to the mobilestation, allowing the UNC to handover calls to and from GSM. It may alsoenable certain location-based services (e.g., E911 Phase 1) that can betied to the location of the GSM cell. An internal database used by theUNC may map GSM location areas to serving UNCs and conserve the amountof data that needs to be managed. This database may only need to changewhen a new UNC or a new GSM location area is added.

If no GSM coverage is available when a mobile station connects to theUNC for UMA service, then, under some instances, the UNC may notreliably determine the location of the mobile station for the purposesof assigning the mobile station to the correct serving UNC (e.g., toenable handover and location-based services). The UNC may permit theoperator to determine the service policy in this case (e.g., theoperator may provide service to the user with certain limitations,possibly with a user interface indication on the mobile station).Additional details on UMA registration and redirection procedures areprovided below.

UMA Mobile Station Idle Mode Behavior

As described above, a UMA device may encounter different radioenvironments as illustrated in FIG. 4. In a first environment, the GSMand UMA coverage areas are completely separate and non-overlapping. In asecond environment, the GSM and UMA coverage is partially overlapping.In a third environment, which may be the most common, the UMA coverageis encapsulated within the GSM coverage. A UMA device may power on inany of these environments and further may transition in a number ofattached states.

At power on, and when the mobile station is idle and there is nocoverage of any type, the mobile station may scan for both GSM and UMAradio coverage. If GSM coverage is detected, then the normal GSMmobility management procedure may be initiated. This condition may applywhen no UMA coverage has been detected by the mobile station when GSMcoverage is detected, or prior to the completion of the UMA registrationprocess. If UMA coverage is detected, then the UMA mobile stationestablishes an unlicensed wireless link (e.g., WLAN link) to the AP andmonitors signal quality. When the received signal level at the mobilestation passes a predefined threshold, the mobile station performs theUMA registration procedure. Based upon the information returned, themobile station may determine if a full network registration is required,and if so, what type (e.g., GSM or combined GSM/GPRS). This proceduremay apply when no GSM coverage exists or when UMA coverage is detectedprior to detecting GSM coverage.

When the mobile station is idle in GSM coverage, and there is no UMAcoverage, the mobile station may periodically scan for UMA coverage. IfUMA coverage is detected, the mobile station may initiate the UMAregistration procedure described above.

When the mobile station is idle in UMA coverage and there is no GSMcoverage, the mobile station may continue to perform normal GSM PLMNsearch procedures. If GSM coverage is detected, the mobile station maysend the GSM cell information to the UNC for possible UMA redirectionpurposes as described above. Alternatively, the mobile station maydisable normal GSM PLMN search procedures to conserve power.

When the mobile station is idle in UMA coverage, and there is GSMcoverage, the mobile station may continue to perform normal GSM cellreselection procedures and may store the identification of the selectedGSM cell to speed the transition to GSM mode, if required.Alternatively, the mobile station may disable normal GSM cellreselection procedures to conserve power.

At power off in UMA coverage, a detach indication may be sent by themobile station to the PLMN via the UMAN (e.g., if required by the PLMNnetwork or normally sent by the mobile station at power off). Thisindication may be encoded per the current GSM mode of operation (e.g.,GSM or GPRS).

The UMA environment may be an IEEE 802.11 environment. In this case, themobile station periodically performs an active scan for available 802.11APs. When an AP is discovered, it may be matched against a storedprofile of user preferences and security credentials, in which case themobile station may automatically associate with the AP. The mobilestation may enter low-power sleep mode, waking up periodically tomeasure signal quality for determining when to trigger UMA registration.

The UMA environment may be a Bluetooth environment. In this case, themobile station previously paired with the Bluetooth AP through which itwill access UMA service. Periodically, the mobile station may enter apage scan receive mode, and respond to an AP transmit page to establisha link-level connection. Once a link-level control channel isestablished, and if the mobile station is not otherwise active, it mayenter a low-power Bluetooth state (e.g., park mode) to conserve power.Periodically, the AP may poll the mobile station to allow it to re-enteractive-power mode. This periodic traffic may also be used by the mobilestation to measure signal quality to determine when to perform the UMAregistration procedure.

UMA Mobile Station Dedicated Mode Behavior

A UMA device engaged in a voice call, a data transaction or asimultaneous voice/data transaction may encounter a transition from GSMcoverage to UMA coverage or a transition from UMA coverage to GSMcoverage. In one embodiment, when the coverage transitions from GSM toUMA coverage, calls may be handed over transparently between the GSM RANand the UMAN. In the case of voice, the handover may be accomplished bya handover function. In the case of data, session management controlsmay provide a common end-user experience to that provided in GPRS.Normal registration actions may occur upon a return to the idle state,if appropriate. When the coverage transitions from UMA to GSM coverage,calls may be handed over transparently between the UMAN and the GSM RAN.In the case of voice, the handover may be accomplished by a handoverfunction. In the case of data, session management controls may provide acommon end-user experience to that provided in GPRS.

Summary of Key Mobility Management Concepts

FIG. 5 illustrates mobility management functions in one exampleembodiment. In FIG. 5, unlicensed network controller UNC-1 is theserving UNC for the UMA cells associated with GSM location areas LA-11to LA-23. UNC-1 maps GSM location areas LA-1 x to UMA cell UMA CGI-101and GSM location areas LA-2 x to UMA CGI-102. Unlicensed networkcontroller UNC-3 is the serving UNC for the UMA cells associated withGSM location areas LA-31 to LA-33. UNC-3 maps GSM location areas LA-3 xto UMA cell UMA CGI-301. Mobile station MS-1 will be in UMA cellUMA-CGI-101 (since GSM LA-x is mapped to UMA-CGI-101). Mobile stationMS-2 will be in UMA cell UMA-CGI-102 (since GSM LA-2 x mapped toUMA-CGI-102). Mobile station MS-3 will be in UMA cell UMA-CGI-301 (sinceGSM LA-3 x mapped to UMA-CGI-301). If mobile station MS-4 connects toUNC-1, it will be in UMA cell UMA-CGI-199 (no GSM coverage). If MS-4connects to UNC-3, it will be in UMA cell UMA-CGI-399 (no GSM coverage).Mobile stations MS-1 and MS-2 may connect to UNC-1 without redirection.If mobile station MS-3 attempts to connect to UNC-1, it may beredirected to UNC-3.

UMA Radio Resource (URR) Messaging and Message Formats

In accordance with aspects of the present invention, details of UMARadio Resource (URR) messaging and corresponding message formats tosupport and manage mobility of mobile stations are now disclosed. Theparticular format of each message is exemplary, and the formats aremerely illustrative of information elements that should and/or may beincluded in a particular implementation, with some of the informationelements being optional.

The UMA-RR messages are conveyed over the Up interface using the TCPconnection. The UMA-RR message format follows the standard GSM layer 3message structure defined in GSM04.07. Each message consists of thefollowing elements:

-   -   1. UMA-RR protocol discriminator—to ease the interworking with        the GSM RR protocol, in one embodiment the UMA-RR protocol        reuses the same protocol discriminator as the GSM RR, which is        the binary sequence of 0110 for bits 3 to 0 of the first octet        of every UMA-RR message. It is noted that this is merely        exemplary, as other sequences may be used, depending on the        particular implementation.    -   2. Skip Indicator—In one embodiment, Bits 5 to 8 of the first        octet of every UMA-RR message contains the skip indicator. An        UMA-RR message received with skip indicator other than 0000        shall be ignored. The UMA-RR entity shall always encode the skip        indicator as 0000.    -   3. Message Type—the message type IE (information element) and        its use are defined in GSM04.07. The UMA-RR message types for        one embodiment are listed in Table 1 below.    -   4. UMA-RR Connection Indicator (UCI)—In one embodiment, the UCI        is used to explicitly indicate the first message on the UMA-RR        connection, versus subsequent messages on the connection. This        allows the MS and the UNC to synchronize their respective UMA-RR        connection states. A UCI is not present in another embodiment.        -   i. The MS normally sets UCI to the value ‘1’ to indicate            that the message is the first on the new UMA-RR connection.        -   ii. However, if the UMA connection is for an emergency call,            the MS sets UCI to the value ‘9’. This allows the UNC to            give priority to emergency call-related UMA-RR connection            requests.        -   iii. For all other messages associated with the UMA-RR            connection, the MS sets UCI to the value ‘0’.        -   iv. For example, if the MM sublayer in the MS requests a new            UMA-RR connection and then sends a CM-SERVICE-REQUEST            message, the UMA-RR entity in the MS sets UCI=1. If the MM            sublayer reuses an existing UMA-RR connection to send the            CM-SERVICE-REQUEST message, the UMA-RR entity in the MS sets            UCI=0. The UCI is used to indicate the implicit allocation            of resources for a UMA-RR session.    -   5. Other information elements, as required.        -   i. The Presence column indicates whether an information            element is mandatory (“M”), optional (“0”) or conditionally            present (“C”).        -   ii. The Format column indicates how the IE is formatted:            “TLV” for tag-length-value format, “LV” for length-value and            “V” for value only. The tag for the IE is also referred to            as the Information Element Identifier (IEI). Mandatory            information elements use “V” or “LV” format, depending on            whether they are fixed or variable length. Optional and            conditional information elements always use “TLV” format.    -   5. Length Indicator. In one embodiment, a separate Length        Indicator IE is used to the length of a given message. In        another embodiment, the underlying transport layer is used to        provide a length indication for each message. Accordingly, a        separate Length Indicator IE is not included in this message        format. Both types of formats are illustrated by the URR        messages disclosed herein.

TABLE 1 MESSAGE NAME MESSAGE TYPE URR REGISTER REQUEST 0011 0011 (0x33)URR REGISTER ACK 0011 0110 (0x36) URR REGISTER REJECT 0011 0111 (0x37)URR ACTIVATE CHANNEL 0010 1110 (0x2E) URR ACTIVATE CHANNEL ACK 0010 1001(0x29) URR ACTIVATE CHANNEL FAILURE 0010 1111 (0x2F) URR ACTIVATECHANNEL COMPLETE 0010 1010 (0x2A) URR HANDOVER REQUIRED 0001 0001 (0x11)URR HANDOVER COMMAND 0010 1011 (0x2B) URR HANDOVER COMPLETE 0010 1100(0x2C) URR HANDOVER FAILURE 0010 1000 (0x28) URR HANDOVER ACCESS 00101101 (0x2D) URR RR RELEASE 0000 1101 (0x0D) URR RR RELEASE COMPLETE 00001111 (0x0F) URR PAGING REQUEST 0010 0001 (0x21) URR PAGING RESPONSE 00100111 (0x27) URR CLASSMARK CHANGE 0001 0110 (0x16) URR CLASSMARK ENQUIRY0001 0011 (0x13) URR RR CLEAR REQUEST 0011 1111 (0x3F) URR DEREGISTER0011 1011 (0x3B) URR UPLINK QUALITY INDICATION 0010 0110 (0x26) URRREGISTER UPDATE UPLINK 0011 1100 (0x3C) URR REGISTER UPDATE DOWNLINK0011 1101 (0x3D)

Registration Messages and Messages Formats

FIGS. 6A-C show examples of sequences of messages that are passedbetween an MS and a UNC (via an AP connected therebetween) under variousregistration scenarios. Messages and associated signals passing betweenthe different elements are shown as horizontal arrows with arrowheadsconnecting the elements of the communication systems that are involved.When the arrow passes across an element and no arrowhead is shown, thenthis element functions as a pass through. The particular elements of thesystem architecture of FIG. 1 that are involved in FIGS. 6A-C are, fromleft to right, a mobile station (e.g., MS 102), an access point (e.g.,WLAN AP 128), a first UNC (e.g., UNC-1 (UNC 140A)) and a second UNC(e.g., UNC-2 (UNC 140B)).

Prior to the registration process, various operations are performed toestablish a connection with between MS102 and AP 128, and then toestablish a connection between MS102 and UNC 140. At step A of FIG. 6A,the MS102 comes into the coverage range of AP 128 and establishes awireless link with the AP. For example, this wireless link may be a WLANconnection using unlicensed frequencies under the IEEE 802.11 orBluetooth protocols. At step B, the MS looks for a UNC to establish aconnection with. This may be done by performing a DNS (Domain NameSystem) query for a UNC. This initiates a connection to the first UNC'sIP address. The MS may select the first UNC because it is the last UNCIP address that it used or it may be a default UNC or it may be a homeUNC that the MS is assigned to for initial registrations, or it may beselected from a cache of connected UNCs indexed by the AP and CGI. Atstep C, the UNC and the MS establish a secure TCP connection. Note thatIPSec security procedures between the MS and UNC are not shown in FIGS.6A-C.

At step D, the MS sends a request for registration embodied as a UMAURR-REGISTER REQUEST message 600 to the UNC. Respective embodiments ofURR REGISTER REQUEST message formats 600A and 600B are shown in FIGS. 7Aand 7B. For illustrative purposes, each message format illustratedherein includes an Information Element column, a Type/Reference column,a Presence column, a Format column, a Length Column, and a Value column.The message formats may also employ IEI Information Element Identifiers(IEIs), which are not shown herein for simplicity and clarity. It isnoted that the actual messages will include a value that identifies themessage type or identity, along with appropriate IE values in accordancewith each particular message format. Also, as with each of the messagesdiscussed herein, URR REGISTER REQUEST message 600 includes a UMA RRprotocol Discriminator IE, a Skip Indicator IE, and a Message Type IE(URR REGISTER REQUEST in this instance). As used herein, these three IEsare referred to as “basic” IEs to indicate they are included in eachmessage format. Additionally, one set of message formats includes a UCIIE, while another set of message formats includes a Length Indicator IEfor each message.

In addition to the basic IEs, URR REGISTER REQUEST message format 600Aincludes a mobile identity IE, a GSM RR State IE, a GPRS ClassCapability IE, a Cell Identifier List IE, a C1 List IE, an AP IdentifierIE, and an AP Location IE. The mobile identity IE is mandatory and usesIMSI or IMEI if IMSI is not available. The GSM RR State IE is includedto indicate the current GSM RR entity state. The GPRS Class CapabilityIE is included to indicate the GPRS Class capability of the MS. The CellIdentifier List IE is included if valid GSM cell information isavailable to the UMA RR entity. Within this IE, the Cell IdentificationDiscriminator field shall be 0000 indicating the Cell GlobalIdentification (CGI) format is used to identify the cells. The C1 ListIE is present only if the “cell identifier list” IE is present. Itcontains the path loss criterion parameter C1 of each cell in the “CellIdentifier List” IE. The AP Identifier IE contains the MAC address ofthe unlicensed interface of the AP through which the MS is registeringwith the UNC. If the AP location is available, the MS can sendcorresponding information identifying the location of the AP via the APLocation IE, such as street address, latitude and longitude, etc.

URR REGISTER REQUEST message format 600B provides similar information inanother format. In addition to the basic IEs, this message formatincludes a the following IEs. The UMA Release Indicator IE is used toidentify the UMA Release supported. The UMA Classmark IE is used toprovide the network with information concerning aspects of both thelicensed and unlicensed radio interfaces, as well as the support for RTPredundancy of the MS equipment. The AP Radio Identity IE and the MSRadio Identity IE are used for transmission of a Bluetooth DeviceAddress (BD_ADDR) or WLAN MAC address for the AP and MS, respectively.The GSM RR State IE is used to indicate the state of the GSM RR entitywhen the MS is registering for UMA service. The Coverage Indication IEis used to indicate the presence of GSM coverage at the current MSlocation.

A Cell Identity IE shall be included if the MS is in an area with GSMcoverage. The Cell Identity value is retrieved from the GSM systeminformation. The most recent Location Area Identification shall beincluded in the Location Area Identification IE if available in the MS.Similarly, the Routing Area Code (RAC) IE shall be included with acorresponding RAC value if available in the MS. The GeographicalLocation IE is a variable length IE providing an estimate of ageographic location of a target MS. The AP Location IE is used toindicate the location of the MS or AP (serving the MS) to the network.

A Register Reject Cause IE shall be included if the MS reattempts a URRRegister Request after failing to connect to a serving UNC, along with aRedirection Counter IE. The conditional Last UNC SGW IP Address IE shallbe include if the conditional IE Serving UNC SGW FQDN IE is notincluded. One of these IEs shall be included if a Register Reject CauseIE is included. Similarly, one of the conditional Last UNC IP Address IEor IE Serving UNC FQDN IE shall be included if a Register Reject CauseIE is included.

The AP Service Name IE shall be included if the MS connect via an APover an unlicensed radio link. The value for this IE will be either theSSID or the PAN Service Name of the unlicensed AP being used. The MSshall include a Registration Indicators IE when attempting to registerto a Default UNC. A UMA PLMN List IE shall be included only whenattempting to register with the Dafault UNC and if no more PLMNs can beselected from the UMA PLMN List received from the Default UNC.

In addition to the foregoing registration content, the URR REGISTERREQUEST message may further include a reason for the connection andinformation about transmitting base stations that are within range (notshown). In a GSM system, this information is labeled Cell-Info andincludes CGI and (optionally) C1 values. In one embodiment, only asingle CGI is reported by the MS, representing the GSM cell that the MShas selected using its normal GSM cell selection procedures. This singlecell has been selected by the MS to be the “best” GSM cell. Typically,to develop such values, the MS will scan certain designated frequenciesto find broadcast channel (BCH) transmissions. The BCH will identify thetransmitting base station and contain information about random accessand traffic channels that are used by the particular base station. TheMS can record the base station identities and measure the quality of theBCH signal as it is received. In GSM systems, the RXLEV (Received SignalLevel) is typically measured but other quality measures may be usedinstead of, or in addition to the RXLEV, including signal to noiseratios, bit error rates, RSSI (Received Signal Strength Indicator) andsignal propagation delays.

The UNC evaluates the received information about location and selectsthe appropriate UNC for the MS. This selection may be maintained for aslong as the MS remains connected to the same AP. As mentioned above,there are a variety of different ways to select the appropriate UNC. Inone embodiment the UNC maps the identification of the AP to a location,to a corresponding MSC and then to a corresponding UNC. In yet anotherembodiment, the UNC has no location information about base stations orthe AP but it has a prior registration from the AP that includedlocation information and selects a UNC on that basis.

In the simplest case, the registration request will be honored by theUNC to which it was submitted by having that UNC return a URRREGISTRATION ACK(nowledgement) message 602, an exemplary format 602A ofwhich is shown in FIG. 8A. Optionally, the message is referred to as aURR REGISTRATION ACCEPT message. One embodiment of a URR REGISTRATIONACCEPT message 602C is shown in FIG. 8C.

The information elements of URR REGISTRATION ACK message format 602Aincludes the basic IEs (e.g., Protocol Discriminator, Skip Indicator,Message Type, and UCI), as well as a UMA System Information IE, a GPRSUplink IP address, a GPRS Uplink UPD port, an Up Parameter ConfigurationIE, and a Status IE. Details of the formatting of one embodiment of theUMA System Information IE are shown in FIG. 8B. Details of the variousfields shown in the UMA System Information IE of FIG. 8C are shownbelow.

GLIR—GSM Location Information Request 0 GSM location information notrequested 1 GSM location information requested

ATT - Attach/detach allowed 0 IMSI attach/detach not allowed in UMA cell1 MSs in the UMA cell shall apply IMSI attach and detach procedure

TI804 - Timer value 000 0 second, i.e., immediate access mode switchingupon receipt of UMA-LINK-DETACH message or link loss 001 5 seconds 01010 seconds 011 15 seconds 100 20 seconds 101 25 seconds 110 30 seconds111 35 seconds

UMA-CELL-RESELECT-HYSTERESIS 000 0 dB RxLev hysteresis 001 2 dB RxLevhysteresis 010 4 dB RxLev hysteresis 011 6 dB RxLev hysteresis 100 8 dBRxLev hysteresis 101 10 dB RxLev hysteresis 110 12 dB RxLev hysteresis111 14 dB RxLev hysteresis

T3212—Periodic Location Update timer

-   -   The T3212 timout value field is coded as the binary        representation of the timeout value for periodic updating in        decihours.    -   Range: 1 to 255    -   The value 0 is used for infinite timeout value, i.e. periodic        updating shall not be used within the UMA cell

EC—Emergency Call Allowed 0 Emergency call allowed in the UMA cell toall MSs 1 Emergency call not allowed in the UMA cell except for the MSsthat belong to one of the classes between 11 to 15

AC CN—Access Control Class N

-   -   For a MS with AC C=N access is not barred if the AC CN bit is        coded with a ‘0’; N=0, 1, . . . , 9, . . . , 15

TI 811—UMA Channel Activation timer

-   -   The TI 811 value field is coded as the binary representation of        the timeout value in 100 ms resolution.    -   Range: 1-255 (100 ms to 25.5 sec)    -   TI 900—GSM to URR HANDOVER supervision timer    -   The TI 900 value field is coded as the binary representation of        the timeout value in 100 ms resolution.    -   Range: 11-255 (1.1 sec to 25.5 sec)

UMA-BAND 0000 P-GSM 900 0001 E-GSM 900 0010 R-GSM 900 0011 DCS 1800 0100PCS 1900 0101 GSM 450 0110 GSM 480 0111 GSM 850 All other values arereserved

ECSM—Early Classmark Sending Mode, control the “early classmark sending”behavior 0 Hold the URR CLASSMARK CHANGE message until the firstdownlink message is received 1 Send the URR CLASSMARK CHANGE message asearly as possible after UMA RR connection is established

GPRS Ind - GPRS Service Availability 0 GPRS service not available in theUMA cell 1 GPRS service supported in the UMA cell

UMA-GPRS-CELL-RESELECT-HYSTERESIS 000  0 dB RxLev hysteresis 001  2 dBRxLev hysteresis 010  4 dB RxLev hysteresis 011  6 dB RxLev hysteresis100  8 dB RxLev hysteresis 101 10 dB RxLev hysteresis 110 12 dB RxLevhysteresis 111 14 dB RxLev hysteresis

NMO—Network Mode of Operation. This field is meaningful only if “GPRSInd” flag is set to 1 00 Network Mode of Operation I 01 Network Mode ofOperation II 10 Network Mode of Operation III 11 Reserved

-   -   UMA-RAC—Routing Area Code of the UMA cell, see GSM03.03. This        field is meaningful only if “GPRS Ind” flag is set to 1

The Up Parameter Configuration IE enables a UNC to configure Upinterface parameters such as timers, retry counters, etc. The Status IEprovides an indication from the UNC on whether location services areavailable (based on knowledge of AP's geographical location). This canbe used to trigger an icon or other display on the MS. In one embodimentthe possible values are:

0 Location Services are Available 1 Location Services are Not Available

In general, URR REGISTER ACCEPT message format 602C includes similarinformation provided in a different format. In addition to the basicIEs, the message format includes the following IEs. The Cell Identity IEand the Location Area Identification IE contain information similar tothat discussed above for the URR REGISTER REQUEST message format 600B.The UNC Control Channel Description IE is used to provide variousinformation about the UMA service. The TU3910, TU3906, TU3920, TU4001,and TU4003 Timer IEs are used for various timer purposes, furtherdetails of which are discussed in the UMA Protocols Stage 3specification. The UMA Band IE includes a coded value identifying theapplicable band for GSM service. The UNC Cell Description IE is used toprovide a minimum description of a UMA cell. The Location Status IE isused to indicate whether the UNC is able to identify the location forthe specific MS. The UMA Service Zone IE is included if the network isconfigured with UMA Service Zone information and contain informationabout the HPLMN.

If the network decides to reject the registration from the MS, the UNCwill return an URR REGISTER REJECT message 604 to the MS, as depicted inthe message sequence shown in FIG. 6B. A URR REGISTER REJECT/REDIRECTMessageformat 604A that is employed in one embodiment of URR REGISTERREJECT message 604 is shown in FIG. 9A. In addition to the basic IEs,message format 604A includes a UMA RR Cause IE, and optional RedirectedUNC Address IE and Redirected SGW (Security Gateway) Address IEs. The RRCause IE contains a value that is used to specify a reason for therejection, such as Network Congestion, AP not allowed, Location notallowed, IMSI not allowed, etc.

A URR REGISTER REJECT message format 604B shown in FIG. 9B may also beemployed under an embodiment that uses separate URR REGISTER REJECT andURR REGISTER REDIRECT messages. The additional IEs in this messageformat include a Register Reject Cause IE that contains a lookup valuefrom which a reason for the rejection can be identified via acorresponding lookup table (not shown). The TU3907 Timer IE is used tospecify the minimum period of time an MS should wait before attemptingRegistration at the current UNC. The Location Black List Indicator IEshall be included if the Register Reject Cause ‘Location not allowed’ isreturned to the MS, and is used to indicate which part of the LocationArea Identification is to be added to the Location Black List. TheLocation Area Identification IE is used to provide an unambiguousidentification of location areas within the area covered by the GSMsystem.

The optional Redirected UNC Address IE and Redirected SGW Address IEs inmessage format 604A may be employed for redirection purposes. Forexample, a registration message sequence that involves UNC redirectionis shown in FIG. 6C. Redirection may be applicable under variouscircumstances. For example, the location of a given AP might be moved,such that it is more advantageous to access the network via another AP.Similarly, an MS may contain information instructing it to access adefault UNC based on a “normal” location of a subscriber—if thesubscriber location is different, the default UNC may not beappropriate.

Referring to FIG. 6C, at step E a determination to redirect the sessionto UNC 2 is made by the serving UNC (e.g., UNC 1) and/or the network inview of applicable criteria as described above. At step F, UNC 1acknowledges the registration request and sends a URR REGISTER REJECTmessage 604 that contains an address for the selected UNC (UNC 2) and/orthe address for the security gateway associated with the UNC to MS102.The address(es) may be in the form of a FQDN (Fully Qualified DomainName) or in another form, such as an IP address. In another embodiment,a separate URR REGISTER REDIRECT message is used, as shown by a URRREGISTER REDIRECT message format 604C in FIG. 9C. In addition to thebasic IEs, this message format will include one of a Serving UNC SGW IPAddress IE or Serving UNC SGW FQDN IE, one of a Serving UNC IP AddressIE or Serving UNC FQDN IE, a Serving UNC Table Indicator IE, an optionalServing UNC Port Number IE, and a conditional UMA PLMN List IE.

At step G, the MS performs a DNS query for the selected UNC. It may alsorelease the TCP connection to the first UNC (UNC 1) and initiate aconnection to the second UNC's IP address or SGW address. Accordingly,at step H, a TCP connection is established between the MS and the newUNC (UNC 2) to which the MS was redirected. At step H, the connection isestablished between the MS and the second UNC. The IPSec tunnel with theoriginal UNC may be reused or a new one may be established (not shown).

At step I, the MS may send a second registration request message to thesecond UNC, as depicted by a URR REGISTER REQUEST message 600′. In aURR-REGISTER-REQUEST type of message, a reason field may carry a valuefor redirection instead of a normal connection. The information in theregistration request may cause the new UNC to apply information that ithas to further redirect the MS. Because it is closer to the location ofthe AP, it may have more or better information on the AP, nearby basestations or network resource allocations and may then further redirectthe MS. The reason field may be used to inform the MS about the numberof redirections. It may be used to limit the total number ofredirections that a MS may experience at a single AP to one or two orany other number.

At step J, the connection with the UNC continues along its normalcourse. This may include registration acknowledgments, call setup andteardown, and any of a variety of different supported voice or dataservices, including security measures.

Registration Update

Under various use scenarios, a need to perform a registration update mayresult. Generally, a registration update procedure may be initiated byan MS (more common) or the network (less common). For example, after anMS has successfully registered to an UNC, the MS may employ aregistration update procedure to inform the UNC if the AP (via which theMS is accessing the network) or the overlapping GSM coverage haschanged.

An example of messaging employed to facilitate an MS-initiatedregistration update is shown in FIG. 10A. At step A, MS102 hasestablished a connection with UNC 140 in the normal manner describedabove. At step B, the MS obtains valid cell information. For example,the MS receives information for a local GSM cell. At step C, the MSsends a URR REGISTER UPDATE UPLINK message 1000 to the UNC. The URRREGISTER UPDATE UPLINK message is sent by an MS to a UNC to updateregistration parameters.

FIG. 11A shows one embodiment of URR REGISTER UPDATE UPLINK messageformat 1000A. In addition to the basic IE's, this message includes aReason IE, a Cell Identifier List IE, a C1 List IE, an AP identifier IE,and an AP Location IE. The Reason IE is a mandatory IE that specifieswhether the reason for the update is due to a cell update or an APupdate. A Cell Identifier List IE will be included if GSM cellinformation (available to the UMA RR entity) has changed since the lastregistration or update. Within this IE, the Cell IdentificationDiscriminator field shall be 0000 indicating the Cell GlobalIdentification (CGI) format is used to identify the cells. The C1 ListIE is present only if the Cell Identifier List IE is present. Itcontains the path loss criterion parameter C1 of each cell in the CellIdentifier List IE. The AP Identifier IE will be included if the APthrough which the MS is communicating with the UNC has changed since thelast registration or update. The AP Identifier is the MAC address of theunlicensed interface of the AP through which the MS is communicatingwith UNC.

A message format 1000B illustrative of another embodiment of a URRREGISTER UPDATE UPLINK message is shown in FIG. 11B. This message formatincludes an AP Radio Identity IE, a Coverage Indication IE, a CellIdentity IE, a Location Area Information IE, a Routing Area Code IE, aGeographical Location IE, and an AP Location IE, each of which areemployed for a similar manner discussed above.

When receiving a URR REGISTER UPDATE UPLINK message, the network mayeither accept or reject the registration update, or redirect the MS toanother UNC. In one embodiment, if there are not any actions to be takenby the UNC (e.g., a change in the access elements for the MS), the UNCsimply accepts the registration update parameters with no reply message.In this case, the URR REGISTER UPDATE UPLINK message is merelyinformative. If the network rejects the registration update, the networksends a URR DEREGISTER message to the MS. Details of a URR DEREGISTERmessage are discussed below. Additionally, depending on the registrationupdate information that is sent in the message, the UNC may redirect theMS to another MS using a URR REGISTER REDIRECT message, as depicted by aURR REGISTER REDIRECT message 604′ at step D in FIG. 10A. In response,normal connection procedures would be established with the new UNC towhich the MS was redirected, as shown in a step E.

FIG. 10B shows various message transfers that may be performed inconnection with a network-initiated registration update. As before, atstep A MS102 has established a connection with UNC 140 in the normalmanner. At step B, a network-initiated update event occurs. At step C,the UNC sends a URR REGISTER UPDATE DOWNLINK message 1002, respectiveembodiments of which are detailed in message formats 1002A and 1002B ofFIGS. 12A and 12B. The URR REGISTER UPDATE DOWNLINK message format 1002Aincludes a Redirected UNC Address IE, a Redirected SGW Address IE, and aStatus IE. The Status IE provides an indication from the UNC on whetherlocation services are available (based on knowledge of the AP'sgeographical location). This can be used to trigger an icon or otherdisplay on the MS. In one embodiment, possible values are:

0 Location Services are Available 1 Location Services are Not Available

Many IEs of URR REGISTER UPDATE DOWNLINK message format 1002B areanalogous to like-named IEs in URR REGISTER ACCEPT message format 602C.These include a Cell Identity IE, a Location Area Identification IE, aUNC Control Channel Description IE, TU3910, TU3906, TU3920, TU4001, andTU4003 Timer IEs, UNC Cell Description IE, and a Location Status IE

Under some conditions, it may be advantageous to have an MS beredirected to re-register with a different UNC in view of the updatedregistration information. If the network decides to redirect the MS toanother UNC, it will send a URR REGISTER REDIRECT message to the MS, asdepicted by a URR Register Redirect message 604B at step D. At step E,normal connection procedures are performed to establish a connectionwith the UNC to which the MS is redirected.

Deregistration

In general, deregistration may be initiated by an MS (e.g., whenderegistering an existing connection) or the network via an appropriateUNC. For instance, the MS should attempt to perform a deregisterprocedure before leaving an AP, which is facilitated by sending a URRDEREGISTER message from the MS to the UNC. Similarly, the UNC mayinitiate deregistration of the MS at any time by sending a URRDEREGISTER message to the MS.

Exemplary URR DEREGISTER message formats 1300A and 1300B are shown inFIGS. 13A and 13B. URR DEREGISTER message format 1300A includes a URRcause IE in addition to the basic IEs. A lookup table containing anexemplary set of values for the URR cause IE are shown in FIG. 14. Basedon the URR cause value, a lookup into the URR cause lookup table may beperformed to identify the reason for the deregistration. Meanwhile, URRDEREGISTER message format 1300B includes a Register Reject Cause IE thatis employed for a similar function. URR DEREGISTER message format 1300Balso includes a Location Black List Indicator IE and a Location AreaIdentification IE.

Channel Activation

Channel activation is used to establish a voice or circuit switched databearer channel. FIG. 15 shows an exemplary message sequence performed inconnection with channel activation. At step A, MS102 has established aconnection with UNC 140 in the normal manner. At step B, the UNC sendsan URR ACTIVATE CHANNEL message 1500 to the MS. In response to receivinga URR ACTIVATE CHANNEL message, the MS attempts to establish acorresponding UMA voice bearer channel. If successful, the MS returns aURR ACTIVATE CHANNEL ACK(nowledge) message 1502, as shown at step C. Ifthe UMA voice bearer channel cannot be established, the MS returns a URRACTIVATE CHANNEL FAILURE message 1504, as shown at step C′. Uponsuccessful activation, a URR ACTIVATE CHANNEL COMPLETE message 1506 issent by the UNC to the MS to indicate that the established voice channelbetween the MS and the UNC is now ready for use, as shown at step D.

FIG. 16A shows details of one embodiment of a URR ACTIVATE CHANNELmessage format 1500A. In addition to the basic IEs, this message formatincludes a Channel Mode IE, a UNC SDP IE, and a CIPHER Mode Setting IE.In one embodiment, the Channel Mode IE specifies the following channelmodes:

0000 0001 speech full rate or half rate version 1 0010 0001 speech fullrate or half rate version 2 0100 0001 speech full rate or half rateversion 3 (AMR version 1)

The UNC SDP (Session Description Protocol) IE is used for specifyinginformation used to implement the uplink (from MS to UNC) portion of thevoice bearer channel. For example, this information may include thenetwork address (IP address), the transport address (port), thetransport protocol (e.g., RTP over UDP), the sample size (e.g., 20 ms)and the payload type (among other things). In one embodiment the formatof this IE's values are defined in RFCs 2327, 3551 and 3267. The use ofa single IE to contain this information is merely exemplary, as suchinformation may also be provided via separate IEs. The optional CIPHERMode Setting IE appears when the ciphering mode is changed after the MShas switched to the assigned channel. If this information element isomitted, the mode of ciphering is not changed after the channelassignment procedure.

FIG. 16B shows another embodiment of a URR ACTIVATE CHANNEL messageformat 1500B. This message format includes a Channel Mode IE, a SampleSize IE, an IP Address IE, an RTP UDP Port IE, a Payload Type IE, aMulti-rate Configuration IE, an RTP Redundancy IE, and a RTCP UDP PortIE. The RTP UDP Port IE identifies the Real Time Protocol UDP port. TheRTCP UDP Port IE identifies the Real Time Control Protocol UDP port. ThePayload Type IE is included when the speech codec signaled uses adynamically assigned Payload Type.

FIG. 17A shows one embodiment of a URR ACTIVATE CHANNEL ACK messageformat 1502A. In addition to the basic IEs, this message format includesan MS SDP IE, an optional Cell Identifier List IE, and a conditional C1list IE. The MS SDP IE is used for specifying information used toimplement the downlink (from UNC to MS) portion of the voice bearerchannel. This IE is substantially analogous to the UNC SDP IE discussedabove, except that the port and address information now pertains to theMS rather than the UNC. The Cell Identifier List IE will be included ifvalid GSM cell information is available to the UMA RR entity. Withinthis IE, the Cell Identification Discriminator field is set to 0000 toindicate the Cell Global Identification (CGI) format is used to identifythe cells. The C1 List IE is present only if the Cell Identifier List IEis present. It contains the path loss criterion parameter C1 of eachcell in the Cell Identifier List IE.

FIG. 17B shows another embodiment of a URR ACTIVATE CHANNEL ACK messageformat 1502B. In addition to the basic TEs, this message format includesan RTP UDP Port IE, a Sample Size IE, a Payload Type IE, and an RTCP UDPPort IE.

FIG. 18A shows one embodiment of a URR ACTIVATE CHANNEL FAILURE messageformat 1504A. The additional TEs include a UMA RR Cause IE, an optionalCell Identifier List IE, and a conditional C1 List IE. The UMA RR CauseIE contains a coded cause of the failure. Meanwhile, the Cell IdentifierList IE and a conditional C1 list IE are the same as above. The URRACTIVATE CHANNEL FAILURE message format 1504B of FIG. 18B also employs aUMA RR Cause IE.

FIGS. 19A and 19B show respective embodiments of URR ACTIVATE CHANNELCOMPLETE message formats 1506A and 1506B. As depicted, each of thesemessage formats only contains their basic IEs, wherein the URR ACTIVATECHANNEL COMPLETE message is identified by the Message Type values.

Handovers

There are two primary types of handovers supported by the network:Handover to UMAN, and handover from UMAN. During a handover to UMAN,network access to an MS is handed over from licensed-based radio accessnetwork (e.g., GERAN) to UMAN network infrastructure. During a handoverfrom UMAN, the MS access is handed over from the UMAN networkinfrastructure to the licensed-based radio access network.

Handover to UMAN

An exemplary message sequence corresponding to a handover to UMAN isshown in FIG. 20. Step A represents an existing connection that haspreviously been established, such as by using the technique shown inFIG. 6A. At step B, a URR HANDOVER ACCESS message 2000 is sent fromMS102 to UNC 140 in response to a corresponding handover order made bythe licensed network. If non-signaling mode is indicated in the ChannelMode IE, the UNC initiates Traffic channel assignment, as depicted atstep C. If the traffic channel assignment is successful, the MS willreturn a URR HANDOVER COMPLETE message 2002 to the UNC, as depicted atstep D.

Respective embodiments of URR HANDOVER ACCESS message formats 2000A and200B are shown in FIGS. 21A and 21B. In addition to the basic IEs,message format 2000A includes a HANDOVER COMMAND message IE, whilemessage format 2000B includes an analogous Handover to UMAN Command IE.Each of these IEs contains a complete HANDOVER COMMAND layer 3 message(as described below) to provide handover reference used by the UMAController for access identification.

FIGS. 22A and 22B shows respective embodiment of URR HANDOVER COMPLETEmessage formats 2002A and 2002B. Each of these message formats includestheir basic IEs, and is identified by the value of the message type.

Handover from UMAN

A handover from the UMAN is performed to transfer a connection betweenan MS and the UMAN to another radio access network (e.g., GERAN).Message sequences corresponding to successful and unsuccessful handoversfrom UMAN are respectively shown in FIGS. 23A and 23B. The handover fromUMAN procedure begins with a connection established and the MS in adedicated state, as shown at step A. In response to a URR UPLINK QUALITYINDICATION message 2300 received from the UNC at step B, or if the MSdetermines a handover is appropriate, the MS sends a URR HANDOVERREQUIRED message 2302 to the UNC at step C. The UNC then sends a URRHANDOVER COMMAND 2304 back to the MS at step D. If the handover fromUMAN is unsuccessful, the MS returns a URR HANDOVER FAILURE message2306, as shown at step E in FIG. 23B.

Details of one embodiment of a URR UPLINK QUALITY INDICATION message areshown in FIG. 24. The message may include various information indicativeof uplink quality of the bearer channel. The particular format of thisinformation is dependent on the particular implementation.

FIG. 25A shows details of one embodiment of a URR HANDOVER REQUIREDmessage format 2302A. In addition to the standard IEs, this messageincludes a Channel Mode IE, and Cell Identifier List, and a C1 List.These latter two IEs are the same as discussed above. In one embodiment,the Channel Mode IE defines the channel mode as specified by GSM04.08.

FIG. 25B shows details of another embodiment of a URR HANDOVER REQUIREDmessage format 2302B. This message format includes a GERAN CellIdentifier List IE, a GERAN Received Signal Level List IE, a UTRAN CellIdentifier List IE, and a UTRAN Received Signal Level List IE. The GERANCell Identifier List IE contains information identifying applicableGERAN cells. The GERAN Received Signal Level List IE includesinformation indicating the received signal level for each GERAN cell.Similarly, the UTRAN Cell Identifier List IE and a UTRAN Received SignalLevel List IE respectively contain information identifying applicableUTRAN cells and their received signal levels.

FIGS. 26A and 26B show details of one embodiment of a URR HANDOVERCOMMAND message message format 2304A. This message format is compiledbased on the HANDOVER COMMAND message format defined in GSM04.08/Release 98, with all optional IEs not applicable to the UMA to GSMhandover removed. This message format includes a number of IEs inaddition to the basic IEs; selected IEs are detailed below.

The Synchronization Indication IE is used to identify what type ofsynchronization is applicable. If this information element does notappear, the assumed value is “non-synchronized”. Four types of handoverdefined in section 3.4.4.2 of GSM04.08: Non-synchronized, Synchronized,Pre-synchronized, and Pseudo-synchronized. The UMA to GSM handover canbe either a non-synchronized or pre-synchronized handover. Synchronizedhandover and pseudo-synchronized handover require the MS to calculatethe timing advance based on known one way delay with the old BTS and theObserved Time Difference between the old and new BTS (more descriptionin annex A of GSM05.10). For a UMA to GSM handover, such variables areunknown. The ROT field of this IE shall be set to 0 so that the MS doesnot need to report its Observed Time Difference in the HANDOVER COMPLETEmessage.

Mode of the First Channel IE: If this information element is notpresent, the channel mode of the previously allocated channel shall beassumed.

Frequency Channel Sequence, Frequency List, Frequency short list andMobile Allocation, after time IEs: If at least one of the channeldescriptions for after time indicates frequency hopping, one of thefollowing information elements will be present:

Frequency Channel Sequence, after time;

Frequency list, after time;

Frequency Short List, after time;

Mobile Allocation, after time.

If neither of the Channel Description IEs indicate frequency hopping, ifthey are not required for the decoding of Channel Description IEs forbefore time, and if any of the four information elements are present,they will be considered as IEs unnecessary in the message.

The Frequency Channel Sequence IE shall not be used unless all theARFCNs that it indicates are in the P-GSM band. The starting time IE isincluded when the network wants the MS to change the frequencyparameters of the channels more or less at the moment a change ofchannel occurs. In this case a number of information elements may beincluded to give the frequency parameters to be used before the startingtime. The starting time IE refers to the new cell time. If the startingtime IE is present and none of the information elements referring tobefore the starting time are present, the MS waits and accesses thechannels at the indicated time. If the starting time IE is present andat least one of the information elements referring to before thestarting time is present, the MS does not wait for the indicated timeand accesses the channel using the frequency parameters for before thestarting time. If the starting time IE is not present and some of theinformation elements referring to before the starting time are present,these information elements shall be considered as IEs unnecessary in themessage.

If the description of the first channel, before time IE is not present,the channel description to apply for before the time, if needed, isgiven by the description of the first channel, after time IE. If thedescription of the second channel, after time IE is present, thedescription of the second channel, before time IE not present, and adescription of the configuration for before the time needed, the channelconfiguration before the starting time is nevertheless of two trafficchannels, and the channel description to apply to the second channelbefore the starting time is given by the description of the secondchannel, after time IE.

If the starting time IE is present and at least one of the channeldescriptions for before the starting time indicates frequency hopping,one and only one of the following information elements may be presentand applies before the starting time to all assigned channels:

Mobile Allocation, before time IE;

Frequency Short list, before time IE;

Frequency list, before time IE;

Frequency channel sequence, before time IE.

If the starting time IE is present and at least one of the channeldescriptions for before the starting time indicates frequency hopping,and none of the above mentioned IE is present, a frequency list forafter the starting time must be present, and this list applies also forthe channels before the starting time.

Reference cell frequency list: If any of the mobile allocationinformation elements are present, then the cell channel description IEmust be present. It is used to decode the mobile allocation IEs in themessage. In addition, if no information elements pertaining to beforethe starting time is present in the message, the frequency list definedby the cell channel description IE is used to decode the mobileallocation IEs in later messages received in the new cell untilreception of a new reference cell frequency list or the new cell isleft.

The Timing Advance IE element will be present if the “synchronizationindication” element indicates a pre-synchronized handover. If notincluded for a pre-synchronized handover, then the default value asdefined in GSM 05.10 shall be used. For other types of handover it shallbe considered as an unnecessary information element.

The CIPHER Mode Setting IE: If this information element is omitted, themode of ciphering is not changed after the MS has switched to theassigned channel. The Multi Rate Configuration IE appears if the Mode ofthe First Channel IE indicates a multi-rate speech codec, and if theassigned configuration is new, i.e. it is different from theMultiRateconfiguration used in the serving cell. If the Mode of theFirst Channel IE indicates a multi-rate speech codec, and this IE is notincluded, then the MS shall assume that the MultiRateconfiguration hasnot changed.

FIG. 26C shows an embodiment of a URR HANDOVER COMMAND message format2304B. In addition to the basic IEs, this message format includes aHandover From UMAN Command IE. IF the target radio access technology isGERAN, the value part of the Handover From UMAN Command IE is coded asthe HANDOVER COMMAND message specified in 3GPP TS 44.018, Rel-4: “Mobileradio interface layer 3 specification, Radio Resource Control (RRC)protocol.”

FIG. 27A shows details of one embodiment of a URR HANDOVER FAILUREmessage format 2406A. In addition to the basic IEs, this messageincludes a UMA RR Cause IE, with an applicable value as defined in thevalue table of FIG. 14. The URR HANDOVER FAILURE message format 2604Bshown in FIG. 27B employs an RR Cause IE for a similar purpose.

Release of URR

Release of the URR connection and signaling may be initiated by the MSor the UNC. FIG. 28 shows a URR release that is initiated by an MS. Atstep A, a connection between MS102 and UNC 140 is established, with theMS operating in the dedicated state. To release the URR, the MS sends aURR CLEAR REQUEST message 2800 to the UNC at step B. Details of oneembodiment of the URR CLEAR REQUEST message are shown in FIG. 29. Thismessage format includes the basic IEs, with the message identified bythe message type value. In response to the URR CLEAR REQUEST message,the UNC sends a release request 2802 to the core network to releaseresources used for the URR connection, as shown at step C. In response,the core network will initiate the release of the appropriate resourcesfor the URR connection. The release typically results in the sequenceshown in FIG. 30.

FIG. 29A shows an embodiment of a URR RR CLEAR REQUEST message format2800A, while FIG. 29B shows an embodiment of a URR CLEAR REQUEST messageformat 2800B. URR RR CLEAR REQUEST message format 2800A just includesits basic IEs and is identified by its message type value. The URR CLEARREQUEST message format 2800B further includes an RR Cause IE.

FIG. 30 shows a message sequence corresponding to an URR release that iseither initiated by the UNC or results when the UNC receives the URRCLEAR REQUEST message. As before, at step A a connection between MS102and UNC 140 is established, with the MS operating in the dedicatedstate. At step B, the UNC sends a URR RR RELEASE message 3000(alternatively called a URR RELEASE message) to the MS. (In furtherdetail, the UNC will typically receive the URR CLEAR REQUEST, sends aClear Request message to the MSC, then the MSC releases the session,resulting in the UNC sending the URR RELEASE message.) In response, theMS returns a URR RR RELEASE COMPLETE message 3002 (alternatively calleda URR RELEASE COMPLETE message) to the UNC at step C. In addition the MSreleases all URR resources and any traffic channel resources and thenenters a URR-IDLE state.

FIGS. 31A and 31B show details of respective embodiments of URR (RR)RELEASE message formats 3000A and 3000B. In addition to the basic IEs,each of these message formats includes a UMA RR Cause IE and an optionalGPRS Resumption IE. The UMA RR Cause IE is used to define the reason forthe release, via a corresponding value defined in the table of FIG. 14.The GPRS (General Packet Radio Service) Resumption IE is used toindicate whether the UNC has successfully resumed a GPRS session thatthe MS suspended when it started the URR session.

FIGS. 32A and 32B show details of respective embodiments of URR (RR)RELEASE COMPLETE message formats 3002A and 3002B. Each of these messageformats includes its basic TEs, with the message identified by themessage type value.

Paging Messages

The UNC initiates paging when it receives a PAGING REQUEST message overthe A-interface or a Paging CS message over the Gb-interface. The MS tobe paged is identified by the identity received in the request. Anexemplary exchange of paging messages is shown in FIG. 33. The sequencestarts with UNC 140 sending a URR PAGING REQUEST message 3300 to MS 102at step A. At step B, the MS returns a URR PAGING RESPONSE message 3302.This message is sent from the MS to the UNC as the first message overthe newly established UMA RR session in response to the URR PAGINGREQUEST message.

FIGS. 34A and 34B show details of respective embodiments of URR PAGINGREQUEST message formats 3300A and 3300B. In addition to their basic IEs,each of these message formats includes a Channel Needed IE (used toindicate whether the page is for signaling session establishment or callestablishment), and a Mobile Identity IE (used to identify the MS).

FIGS. 35A and 35B show details of respective embodiments of URR PAGINGRESPONSE message formats 3302A and 3302B. In addition to their basicIEs, each of these message formats includes a Ciphering Key SequenceNumber IE, a Channel Needed IE, and a Mobile Identity IE. MG: Thepurpose of the Ciphering Key Sequence Number information element is tomake it possible for the network to identify the ciphering key KC whichis stored in the mobile station without invoking an authenticationprocedure. K_(c) gets generated and stored when the MS is authenticated(challenged with a random number) by the network. While K_(c) is notused to encrypt the call when in UMA mode, it may be necessary if thecall gets handed over to GSM. If the network does not authenticate everycall (e.g., every 3 or 4 calls), the Ciphering Key Sequence Number IEprovides a way to select a stored KC value. URR PAGING RESPONSE messageformat 3302B further includes an Establishment Cause IE, which is usedby the MS to indicate the type of the transaction being initiated to thenetwork via a coded value which may be identified by a correspondinglookup table.

Classmark Messages

Classmark messages are used to enable a UNC to gain information about anMS's capabilities. The classmark interrogation procedure may beinitiated when the MS has established a dedicated connection (i.e., theMS is in URR-DEDICATED mode), as shown at step A in FIG. 36. As shown atstep B, the UNC initiates the classmark interrogation procedure bysending a URR CLASSMARK ENQUIRY message 3600 to the MS. In response, theMS returns a URR CLASSMARK CHANGE message 3602 at step C.

FIG. 37A shows details of one embodiment of a URR CLASSMARK ENQUIRYmessage format 3600A. The illustrated message format includes the basicIEs, with the message being identified by the message type value. Inaddition to the basic IEs, the URR CLASSMARK ENQUIRY message format3600A of FIG. 37B includes a Classmark Enquiry Mask IE. This IE definesthe information to be returned to the network. The bit mask defines thespecific information to be returned, such as UTRAN specificationinformation and/or requests the sending of the URR CLASSMARK CHANGEmessage.

FIGS. 38A and 38B show details of respective embodiments of URRCLASSMARK CHANGE message formats 3602A and 3602B. In addition to theirbasic IEs, each of these message formats includes a Mobile StateClassmark IE, and an Additional Mobile Station Classmark Information IE.Under message format 3602A, the Mobile State Classmark IE includes theClassmark 2 information corresponding to the frequency band currentlybeing used by the GSM RR entity, as defined by GSM04.08. In oneembodiment, an Additional Mobile Station Classmark Information IE willbe included if the CM3 bit in the Mobile Station Classmark IE is setto 1. This IE provides additional MS capabilities for Classmark 3 asdefined by GSM04.08. The Mobile State Classmark IE and Additional MobileStation Classmark Information IE of message format 3602B are encoded perthe 3GPP TS 24.008, Rel-4 specification: “Mobile radio interface layer 3specificaton.”

UNC Architecture

A block diagram illustrating a high level architecture corresponding toone embodiment of a UNC is shown in FIG. 39. At the heart of the UNCarchitecture is an indoor network controller (INC) 3900. In general, theINC performs operations synonymous to those described above for the UNC.However, as shown in the illustrated UNC architecture, an integratedsecurity gateway server 3902 is included, as well as a media gateway3904 which is controlled by the INC. Accordingly, each of these elementsis shown as a separate element that is employed to facilitate variousaspects of the UNC operations described herein.

In general, the UNC may provide one or more communication ports tosupport communications between mobile stations and the UNC (e.g., viaand AP 128 and broadband IP network 138 as shown in FIG. 1). Forexample, in the illustrated embodiment of FIG. 39, security gatewayserver 3902 is coupled to IP network 138 via an IP port 3906. Inaddition, IP ports 3908 and 3910 are used to connect INC 3900 and mediagateway 3904 to the security gateway server.

The security gateway server 3902 performs security and authenticationservices. It may be an integrated unit (as shown), or may be a separate(physical) unit connected to the UNC via an appropriate communicationlink. Likewise, media gateway 3904, which serves as a media gateway forvoice services provided by the core network, may comprise an integratedunit (as shown) or a separate unit connected to the INC and securitygateway servers via appropriate communication links.

The INC 3900 includes resources to support (i.e., generate and process)the UP interface messages described herein. These resources are depictedas UP Interface (I/F) logic 3912. Similarly, INC 3900 includes SGSNinterface logic 3914 to support communications with SGSN 114 via a Gbport 3916, and MSC interface logic 3918 to support communication withMSC 110 via an SS7 port 3920. Meanwhile, media gateway 3904 includes MSCinterface logic 3922 to support communication with MSC 110 via a TDMport 3924. Each of UP interface logic 3912, SGSN interface logic 3914,and MSC interface logic 3918 and 3922 may be implemented via executionof software, built-in programmed hardware, or a combination of the two.For example, UP interface logic 3912 may be facilitated by executing oneor more software modules on a processor, wherein the software modulesare coded to generate and/or process URR messages.

In general, a UNC may be implemented by a single server, multipledistributed servers, and multiple clustered servers. For example, asingle server 3926 may be employed for running various softwareapplications to provide the various functions shown in the block diagramof the UNC architecture of FIG. 39. Optionally, some of the functions,such as the security gateway server functions and/or media gatewayfunctions, may be provided by a separate server or servers. In yetanother configuration, a blade server 3928 is employed. The blade serverincludes multiple server blades 3930 that are installed in a common rackor chassis, with each server blade functioning as a separate server,each with its own processor(s), memory, and network interfaces. In oneembodiment, the functions provided by each of the security gatewayserver 3902, INC 3900, and media gateway 3904 are facilitated viaexecution of software applications and/or modules on respective serverblades 3930.

Mobile Station Architecture

FIG. 40 shows a block diagram illustrating a high-level architecture forone embodiment of a mobile station. The architecture includes aprocessor 4000 coupled to a non-volatile memory 4002, a licensed RANantenna sub-system 4004 and an unlicensed RAN antenna sub-system 4006.Non-volatile memory 4002 is used to store software/firmware instructionsfor performing various functions and operations described herein. Thesefunctions and operations are depicted licensed RAN interface logic 4008,WLAN interface logic 4010, and Up interface logic 4012.

Licensed RAN antenna subs-system 4004 and licensed RAN interface logic4008 are employed to facilitate conventional licensed RAN operations.For example, in one embodiment the licensed RAN comprises a GSM network,and thus these components facilitate normal GSM network operationstypically employed by GSM-based cellular devices and the like, which arewell-known in the cellular communication art. Meanwhile, the unlicensedRAN antenna system 4006 and WLAN interface logic 4010 are used tosupport an unlicensed wireless channel (i.e., link) 136 with an accesspoint 128 via which UMAN services may be accessed. In general, theseblocks represent conventional components and logic employed to supportcommunications over an unlicensed WLAN link. For example, thesecomponents are illustrative of components that may be employed toimplement the Bluetooth lower layers shown in FIG. 3B for a Bluetoothlink, or the 802.11 lower layers shown in FIG. 3C for an 802.11 link.

Up interface logic 4012 is used to provide the MS-side Up interfacefunctions and operations described herein. This includes generating andprocessing various URR messages, as well as providing the various UPinterface layers depicted in FIGS. 3A and 3D-F.

As discussed above, the various message formats depicted herein areexemplary. However, each message should include a basic set ofinformation elements including a protocol discriminator, a skipindicator, and a message identity. The inclusion of an UCI informationelement as a basic IE is depicted in the exemplary message formatsillustrated herein; however, the UCI IE or a similar IE for indicatingwhether a message is a first message, other message, oremergency-related is not required and this functionality may befacilitated by other means, such as by maintaining appropriate stateinformation on the communicating devices (i.e., mobile stations andUNCs).

Under a proposed implementation, message delineation over a streamingtransport (e.g., TCP) is performed by the underlying transport itself.Accordingly, there is not a need to include an information elementspecifying the length of a variable-length message format. However, thisis not meant to be limiting, as the use of an information element forspecifying the length of a message is contemplated by the inventors asanother means for delineating streamed messages.

The formats of the various information elements is also merelyexemplary. For example, a given set of information may be provided via asingle IE or via multiple IEs. Furthermore, the information contained inthe IEs depicted herein may be arranged in other formats and/or groupedin alternate manners.

The means for facilitating various message generation and processingoperations, as well as various aspects of the Up interface may includeexecution of software/firmware instructions on an appropriate processingelement, such as, but not limited to, a processor, multiple processors,a multi-core processor, a microcontroller, etc. Thus, embodiments ofthis invention may be used as or to support instructions executed uponsome form of processing core or otherwise implemented or realized uponor within a machine-readable medium. A machine-readable medium includesany mechanism for storing or transmitting information in a form readableby a machine (e.g., a computer). For example, a machine-readable mediumcan include a read only memory (ROM); a random access memory (RAM); amagnetic disk storage media; an optical storage media; and a flashmemory device, etc. In addition, a machine-readable medium can includepropagated signals such as electrical, optical, acoustical or other formof propagated signals (e.g., carrier waves, infrared signals, digitalsignals, etc.). For example, in one contemplated implementation,instructions embodied as software upgrades for facilitating UMAmessaging may be downloaded to a mobile device via a wireless link, suchas a UMAN or GSM link.

The above description of illustrated embodiments of the invention,including what is described in the Abstract, is not intended to beexhaustive or to limit the invention to the precise forms disclosed.While specific embodiments of, and examples for, the invention aredescribed herein for illustrative purposes, various equivalentmodifications are possible within the scope of the invention, as thoseskilled in the relevant art will recognize.

These modifications can be made to the invention in light of the abovedetailed description. The terms used in the following claims should notbe construed to limit the invention to the specific embodimentsdisclosed in the specification and the drawings. Rather, the scope ofthe invention is to be determined entirely by the following claims,which are to be construed in accordance with established doctrines ofclaim interpretation.

APPENDIX I Table Of Acronyms AP Access Point ARFCN Absolute RF ChannelNumber ATM Asynchronous Transfer Mode ATM VC ATM Virtual Circuit BA BCCHAllocation BAS Broadband Access System BB Broadband BCCH BroadcastCommon Control Channel BRAS Broadband Remote Access System BSC BaseStation Controller BSS Base Station Subsystem BSSGP Base Station SystemGPRS Protocol BSSMAP Base Station System Management Application Part BTSBase Transceiver Station CDMA Code Division Multiple Access CGI CellGlobal Identification CIC Circuit Identity Code CLIP Calling LinePresentation CM Connection Management CPE Customer Premises Equipment CSCircuit Switched CVSD Continuos Variable Slope Delta modulation DSLDigital Subscriber Line DSLAM DSL Access Multiplexer DTAP DirectTransfer Application Part ETSI European Telecommunications StandardsInstitute FCAPS Fault-management, Configuration, Accounting,Performance, and Security FCC US Federal Communications Commission GERANGSM Edge Radio Access Network GGSN Gateway GPRS Support Node GMM/SM GPRSMobility Management and Session Management GMSC Gateway MSC GSM GlobalSystem for Mobile Communication GPRS General Packet Radio Service GSNGPRS Support Node GTP GPRS Tunnelling Protocol HLR Home LocationRegister IAN Indoor Access Network (see also UMA Cell) IAN-RR IndoorAccess Network Radio Resource Management IBS Indoor Base Station. IBSAPIBS Application Protocol IBSMAP IBS Management Application Protocol IEPIAN Encapsulation Protocol IETF Internet Engineering Task Force IMEIInternational Mobile Station Equipment Identity IMSI InternationalMobile Subscriber Identity INC Indoor Network Controller INC IndoorNetwork Controller IP Internet Protocol ISDN Integrated Services DigitalNetwork ISP Internet Service Provider ISP IP Internet Service Provider'sIP IST IAN Secure Tunnel ISUP ISDN User Part ITP IAN Transfer ProtocolLA Location Area LAI Location Area Identification LLC Logical LinkControl MAC Medium Access Control MAP Mobile Application Part MDN MobileDirectory Number MG Media Gateway MM Mobility Management MM MobilityManagement MS Mobile Station MSC Mobile Switching Center MSC MobileSwitching Center MSISDN Mobile Station International ISDN Number MSRNMobile Station Roaming Number MTP1 Message Transfer Part Layer 1 MTP2Message Transfer Part Layer 2 MTP3 Message Transfer Part Layer 3 NAPTNetwork Address and Port Translation NAT Network Address Translation NSNetwork Service PCM Pulse Code Modulation PCS Personal CommunicationServices PCS Personal Communications Services PLMN Public Land MobileNetwork POTS Plain Old Telephone Service PPP Point-to-Point ProtocolPPPoE PPP over Ethernet protocol PSTN Public Switched Telephone NetworkP-TMSI Packet Temporary Mobile Subscriber Identity QoS Quality ofService RA Routing Area RAC Routing Area Code RAI Routing AreaIdentification RAI Routing Area Identity RAN Radio Access Network RFRadio Frequency RFC Request for Comment (IETF Standard) RLC Radio LinkControl RR Radio Resource Management RTCP Real Time Control ProtocolRTCP Real Time Control Protocol RTP Real Time Protocol RTP Real TimeProtocol SAP Service Access Point SCCP Signaling Connection Control PartSCO Synchronous Connection-Oriented SDCCH Standalone Dedicated ControlChannel SGSN Serving GPRS Support Node SMC Short Message Service CentreSMS Short Message Service SM-SC Short Message Service Centre SMS-GMSCShort Message Service Gateway MSC SMS-IWMSC Short Message ServiceInterworking MSC SNDCP SubNetwork Dependent Convergence Protocol SSSupplementary Service SSL Secure Sockets Layer TCAP TransactionCapabilities Application Part TCP Transmission Control Protocol TCPTransmission Control Protocol TLLI Temporary Logical Link Identity TMSITemporary Mobile Subscriber Identity TRAU Transcoder and Rate AdaptationUnit TTY Text telephone or teletypewriter UDP User Datagram Protocol UMACell Unlicensed Mobile Access Cell (see also IAN) UMTS Universal MobileTelecommunication System UNC UMA Network Controller (see also INC) VLRVisited Location Register VMSC Visited MSC WLAN Wireless Local AreaNetwork WSP IP Wireless Service Provider's IP Network

1-35. (canceled)
 36. A method comprising: establishing a secure linkbetween a particular service region of a first communication network anda network controller of the first communication network forcommunicatively coupling the particular service region to a licensedwireless second communication network to allow a communication sessionbetween a telecommunication device in the particular service region andthe second communication network; and sending a plurality ofregistration messages between the particular service region and thenetwork controller over the secure link including a registration requestsent from the particular service region to the network controller, saidregistration request comprising a set of basic information elements anda set of operating parameters for the telecommunication device.
 37. Themethod of claim 36, wherein the secure link comprises a TCP(Transmission Control Protocol) session between the particular serviceregion and the network controller.
 38. The method of claim 36, whereinthe basic information elements comprise a protocol discriminator, a skipindicator, and a message type via which the message may be identified.39. The method of claim 36, wherein the set of operating parameters forthe telecommunication device comprises a mobile identity via which thetelecommunication device is identified and a state information elementfor defining an operating state of the telecommunication device.
 40. Themethod of claim 39, wherein the particular service region comprises anaccess point for wirelessly coupling the telecommunication device at theparticular service region to the network controller, wherein the set ofoperating parameters for the telecommunication device further comprise amedia access control (MAC) address of the access point.
 41. The methodof claim 36, wherein said sending of the plurality of registrationmessages comprises a registration acknowledgement message sent from thenetwork controller to the particular service region, said registrationacknowledgement message comprising the set of basic information elementsand a set of operating parameters for the first communication network.42. The method of claim 41, wherein the set of operating parameters forthe first communication network comprises a location area identifier foridentifying a plurality of service regions of the first communicationnetwork and a cell identifier for identifying the particular serviceregion within the plurality of service regions.
 43. The method of claim36, wherein said sending of the registration acknowledgement messageoccurs when the telecommunication device is authorized to access thefirst communication network, the method further comprising sending aregistration reject message to the particular service region when thetelecommunication device in the particular service region is notauthorized to access the first communication network, wherein theregistration reject message comprises the set of basic informationelements and a cause parameter for specifying a reason for rejection.44. The method of claim 43, wherein the cause parameter also specifies aredirect address for redirecting the telecommunication device to adifferent network controller of the first communication network, whereinthe address for redirecting the telecommunication device comprises an IPaddress for the different network controller.
 45. A method comprising:from a telecommunication device at a particular service region of afirst communication network, identifying a network controller of thefirst communication network for communicatively coupling thetelecommunication device at the particular service region to a licensedwireless second communication network to allow a communication sessionbetween the telecommunication device and the second communicationnetwork; establishing a secure link with the network controller; andfrom the telecommunication device, sending a registration requestmessage to the network controller over the secure link comprising a setof basic information elements and a set of operating parameters for thetelecommunication device.
 46. The method of claim 45, whereinidentifying the network controller comprises performing a domain namesystem query to identify an IP address for communicating with saidnetwork controller.
 47. The method of claim 45, wherein identifying thenetwork controller comprises identifying a last IP address of a networkcontroller via which the telecommunication device connected to the firstcommunication network.
 48. The method of claim 45, wherein identifyingthe network controller comprises identifying a default IP address of anetwork controller via which the telecommunication device initiallyconnects to when registering for service with the first communicationnetwork.
 49. A method comprising: at a network controller of a firstcommunication network that communicatively couples a plurality ofservice regions of the first communication network to a licensedwireless second communication network, receiving a registration requestmessage from a particular service region of the first communicationnetwork; determining from the registration message whether atelecommunication device in the particular service region is permittedaccess to the first communication network; and from the networkcontroller, sending a registration reject message to the particularservice region when the telecommunication device is not authorized toaccess the first communication network, wherein the registration rejectmessage comprises a set of basic information elements and a causeparameter for specifying a reason for rejection.
 50. The method of claim45, wherein the basic information elements comprise a protocoldiscriminator, a skip indicator, and a message type via which themessage may be identified.
 51. The method of claim 45, wherein the causeparameter comprises a redirect address for redirecting thetelecommunication device to a different network controller, wherein theredirect address comprises an IP address for the different networkcontroller.
 52. The method of claim 45, wherein the cause parametercomprises a rejection due to network congestion.
 53. The method of claim45, wherein the cause parameter comprises a rejection due to thetelecommunication device accessing an access point of the firstcommunication network through which said telecommunication device is notauthorized to access, said access point for wirelessly coupling thetelecommunication device at the particular service region to the networkcontroller.
 54. The method of claim 45, wherein the cause parametercomprises a rejection due to an international mobile subscriber identity(IMSI) of the telecommunication device not being allowed for service inthe first communication network.
 55. A method comprising: at a networkcontroller of a first communication network that communicatively couplesa plurality of service regions of the first communication network to alicensed wireless second communication network, registering atelecommunication device at a particular service region of the firstcommunication network to access services of the first communicationnetwork; at the network controller, receiving a registration updatemessage from the particular service region, wherein the registrationupdate message comprises a set of basic information elements and a setof updated operating parameters of the telecommunication device.
 56. Themethod of claim 55, wherein the plurality of service regions eachcomprise an access point for communicatively coupling atelecommunication device to the network controller, wherein the set ofupdated operating parameters comprises updating the network controllerwith an identifier for identifying a different access point for adifferent service region when the telecommunication device changes firstnetwork service regions, wherein the identifier for identifying thedifferent access point comprises a media access control (MAC) address ofthe different access point.
 57. The method of claim 55, wherein the setof updated operating parameters comprise updating the network controllerwith a location area identifier and cell identifier for a service regionof the second communication network when the telecommunication devicechanges second network service regions.
 58. A method comprising: at anetwork controller of a first communication network that communicativelycouples a plurality of service regions of the first communicationnetwork to a licensed wireless second communication network, registeringa telecommunication device at a particular service region of the firstcommunication network to access services the first communicationnetwork; at the network controller, detecting an update event initiatedby the second communication network; and from the network controller,sending a registration update message to the particular service region,wherein the registration update message comprises a set of basicinformation elements and updated network information for the firstcommunication network.
 59. The method of claim 58, wherein theregistration update message comprises a location area identifier when alocation area identifier for the particular service region is changed.60. The method of claim 58, wherein the registration update messagecomprises a cell identifier when a cell identifier for the particularservice region is changed.